[pcap-ng-format] The record length in the Name Resolution Block appears to be a record *value* length

Guy Harris guy at alum.mit.edu
Thu May 10 11:24:35 PDT 2012


In section 3.6 "Name Resolution Block (optional)" of the pcap-NG spec, it says:

   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  +---------------------------------------------------------------+
0 |                    Block Type = 0x00000004                    |
  +---------------------------------------------------------------+
4 |                      Block Total Length                       |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
8 |      Record Type              |         Record Length         |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
12 /                       Record Value                            /
  /          /* variable length, aligned to 32 bits */            /
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  .                                                               .
  .                  . . . other records . . .                    .
  .                                                               .
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |  Record Type == end_of_recs   |  Record Length == 00          |
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  /                                                               /
  /                      Options (variable)                       /
  /                                                               /
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  |                      Block Total Length                       |
  +---------------------------------------------------------------+

		...

	Each Record Value is aligned to a 32-bit boundary. The corresponding Record Length reflects the actual length of the Record Value.

From "reflects the actual length of the Record Value", and from the end_of_recs record having a length 0f 0, that sounds as if the Record Length does *NOT* include the Record Type and Record Length fields.  The spec should perhaps say that a bit more explicitly, or perhaps rename that field to "Record Value Length".


More information about the pcap-ng-format mailing list