[pcap-ng-format] The record length in the Name Resolution Block appears to be a record *value* length

Guy Harris guy at alum.mit.edu
Thu May 29 22:41:12 UTC 2014


On May 10, 2012, at 11:24 AM, Guy Harris <guy at alum.mit.edu> wrote:

> In section 3.6 "Name Resolution Block (optional)" of the pcap-NG spec, it says:
> 
> 		...
> 
> 	Each Record Value is aligned to a 32-bit boundary. The corresponding Record Length reflects the actual length of the Record Value.
> 
> From "reflects the actual length of the Record Value", and from the end_of_recs record having a length 0f 0, that sounds as if the Record Length does *NOT* include the Record Type and Record Length fields.  The spec should perhaps say that a bit more explicitly, or perhaps rename that field to "Record Value Length".

Done, including renaming the field.



More information about the pcap-ng-format mailing list