diff options
| author | Guy Harris <guy@alum.mit.edu> | 2007-08-17 20:04:31 +0000 |
|---|---|---|
| committer | Guy Harris <guy@alum.mit.edu> | 2007-08-17 20:04:31 +0000 |
| commit | c193066114d898688d24f16a80a3255fcfba2d34 (patch) | |
| tree | 75c3f7f0a3f932aed2775a90aac5e3ca115d968b /wiretap/netxray.c | |
| parent | 98688eb8287715ea0b5f1e58ccea9280ad5cc551 (diff) | |
At least some LAPB Windows Sniffer captures have 4 bytes of extra stuff
at the ends of packets.
svn path=/trunk/; revision=22540
Diffstat (limited to 'wiretap/netxray.c')
| -rw-r--r-- | wiretap/netxray.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/wiretap/netxray.c b/wiretap/netxray.c index c665350254..38008bc3d7 100644 --- a/wiretap/netxray.c +++ b/wiretap/netxray.c @@ -782,6 +782,7 @@ int netxray_open(wtap *wth, int *err, gchar **err_info) case WTAP_ENCAP_ETHERNET: case WTAP_ENCAP_IEEE_802_11_WITH_RADIO: case WTAP_ENCAP_ISDN: + case WTAP_ENCAP_LAPB: /* * It appears that, in at least some version 2 Ethernet * captures, for frames that have 0xff in hdr_2_x.xxx[2] @@ -1303,6 +1304,28 @@ netxray_set_pseudo_header(wtap *wth, const guint8 *pd, int len, */ pseudo_header->x25.flags = (hdr->hdr_2_x.xxx[12] & 0x01) ? 0x00 : FROM_DCE; + + /* + * It appears, at least with version 2 captures, + * that we have 4 bytes of stuff (which might be + * a valid FCS or might be junk) at the end of + * the packet if hdr->hdr_2_x.xxx[2] and + * hdr->hdr_2_x.xxx[3] are 0xff, and we don't if + * they don't. + * + * XXX - does the low-order bit of hdr->hdr_2_x.xxx[8] + * indicate a bad FCS, as is the case with + * Ethernet? + */ + if (hdr->hdr_2_x.xxx[2] == 0xff && + hdr->hdr_2_x.xxx[3] == 0xff) { + /* + * FCS, or junk, at the end. + * XXX - is it an FCS if "fcs_valid" is + * true? + */ + padding = 4; + } break; case WTAP_ENCAP_PPP_WITH_PHDR: |