Re: Request for new DLT value for Wireshark Dissector

[Schemmel, Hans-Christoph <Hans-Christoph.Schemmel () cinterion com>]

Guy Harris <guy <at> alum.mit.edu> writes:

> Start_Pos and End_Pos are relative to the beginning of MUX_Frame, right? 
I.e., a 4-byte chunk starting at
> the beginning of MUX_Frame would have a Start_POS of 0?  Would End_POS be 3
(meaning that it's the offset of
> the last byte of the chunk) or 4 (meaning that it's the offset one byte
*after* the last byte of the chunk)?
>


Yes, Start_Pos and End_Pos are relative to the beginning of the MUX_Frame, but a
PPP chunk does not start directly at the beginning of a MUX_Frame (Start_Pos=0).
The PPP frame starts after the header fields of the MUX_Frame. 
I.e. if we have 4 octets for the MUX_Frame header (flag, address, contol &
length) and a 4-byte PPP chunk, Start_Pos would be *5* (the 5th byte in the
MUX_Frame is the first byte of the PPP frame) and End_Pos would be *8* (the 8th
byte in the MUX_Frame is the last byte of the PPP frame).


Kind regards,
Christoph Schemmel

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.