[pcap-ng-format] Is the if_fcslen option in the Interface Description Block in units of bits or bytes?

Guy Harris guy at alum.mit.edu
Sun Mar 3 10:27:23 UTC 2019


The Interface Description Block description in the pcapng specification:

	http://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#rfc.section.4.2

says that the `if_fcslen` option's value for the FCS length is in units of bits.

Wireshark, however, treats it as if it's in units of bytes.

Are there any programs that write out an `if_fcslen` option in the Interface Description Block?  If so, does they write it out in units of bits or bytes?

I've filed an issue about this on the GitHub page for the pcapng specification:

	https://github.com/pcapng/pcapng/issues/60

Continue discussion there (rather than here).


More information about the pcap-ng-format mailing list