[pcap-ng-format] The captured length of an SBP packet must take into account the packet length

Guy Harris guy at alum.mit.edu
Sat Sep 28 20:49:25 UTC 2013


On Sep 28, 2013, at 1:33 PM, Guy Harris <guy at alum.mit.edu> wrote:

> The spec speaks of the snapshot length, but not the packet length.

No, it does:

	Packet Data: the data coming from the network, including link-layers headers. The length of this field can be derived from the field Block Total Length, present in the Block Header, and it is the minimum value among the SnapLen (present in the Interface Description Block) and the Packet Len (present in this header).


More information about the pcap-ng-format mailing list