[pcap-ng-format] The record length in the Name Resolution Block appears to be a record *value* length
Guy Harris
guy at alum.mit.edu
Thu May 29 22:41:12 UTC 2014
On May 10, 2012, at 11:24 AM, Guy Harris <guy at alum.mit.edu> wrote:
> In section 3.6 "Name Resolution Block (optional)" of the pcap-NG spec, it says:
>
> ...
>
> Each Record Value is aligned to a 32-bit boundary. The corresponding Record Length reflects the actual length of the Record Value.
>
> From "reflects the actual length of the Record Value", and from the end_of_recs record having a length 0f 0, that sounds as if the Record Length does *NOT* include the Record Type and Record Length fields. The spec should perhaps say that a bit more explicitly, or perhaps rename that field to "Record Value Length".
Done, including renaming the field.
More information about the pcap-ng-format
mailing list