[pcap-ng-format] Does the block total length include any padding required by the contents?

Richard Sharpe realrichardsharpe at gmail.com
Sat May 12 08:42:42 PDT 2012


Hi,

In writing code to parse pcapng files so I can pipe a pacpng capture
into Wireshark I came across an interesting problem with the
icmp2.ntar file here: http://wiki.wireshark.org/Development/PcapNg

The Packet blocks have a block total length that does not seem to
include the padding required by the block, however, it seems that the
block total length in the SHB does including the padding in the blocks
it describes.

Each PB is actually 112 bytes long (the captured frame is 78 bytes but
it is padded to 80 bytes.) The block total length is listed as 110
bytes (0x6E) not 112 (0x70).

Can someone clarify whether or not the block total length should
include the padding. If not, it complicates my parser slightly.

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)


More information about the pcap-ng-format mailing list