Re: Link Layer Type Request NETANALYZER_NG

[Guy Harris via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Guy Harris <gharris () sonic net>
>
> Date: Fri, 12 Mar 2021 11:37:46 -0800
>
> On Mar 12, 2021, at 4:35 AM, Jan Adam <JAdam () hilscher com> wrote:
>
> > > So is "the variable" the same thing as "the payload"?
> >
> > That is correct. To be more specific the payload is the value/content of the variable.
>
> Can the variable be anything *other* than a packet of some sort?  The current set of values for the variable listed in 
> https://kb.hilscher.com/x/brDJBw:
>
>     0x01:       netANALYZER legacy frame
>     0x02:       Ethernet (may also be a re-assembled mpacket)
>     0x03:       mpacket
>     0x04:       PROFIBUS frame
>     0x05:       IO-Link frame
>
> lists only packets of various types, but I was reading "variable" in the programming language sense, rather than in the 
> sense that the total content has a "fixed part", that being the trailer, and a "variable part", that being the packet 
> preceding the trailer.  Is the latter the sense in which the word "variable" should be understood?
>
> It also appears that the boundary between the payload and the trailer would be determined by fetching the VarSize field 
> at the end of the trailer.  The first VarSize bytes of the data would be the payload, and the remaining sizeof(footer) 
> bytes would be the trailer.  Is that the case?
>
> That would also indicate that the "captured length" value for a pcap record or a pcapng block containing NETANALYZER_NG 
> data must be >= sizeof(footer), so that the entire footer is present.
>
> This also means that NETANALYZER_NG data must *not* be cut off at the end by any "slicing" process, such as capturing 
> with a "slice length"/"snapshot length".  Is it possible that the frame in the payload is "sliced" in that fashion?
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers