From d5263942b54afde6632bd4f0ef08dcd77e2b18b2 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 6 Feb 2004 03:12:21 +0000 Subject: Ethernet frames appear to have 4 bytes of 0 at the end, at least in the captures I've seen. svn path=/trunk/; revision=9991 --- wiretap/airopeek9.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) (limited to 'wiretap') diff --git a/wiretap/airopeek9.c b/wiretap/airopeek9.c index 9647c9008a..8b04a36e59 100644 --- a/wiretap/airopeek9.c +++ b/wiretap/airopeek9.c @@ -1,7 +1,7 @@ /* airopeek9.c * Routines for opening EtherPeek and AiroPeek V9 files * - * $Id: airopeek9.c,v 1.6 2004/02/06 02:11:52 guy Exp $ + * $Id: airopeek9.c,v 1.7 2004/02/06 03:12:21 guy Exp $ * * Wiretap Library * Copyright (c) 1998 by Gilbert Ramirez @@ -326,7 +326,7 @@ airopeekv9_process_header(FILE_T fh, hdr_info_t *hdr_info, int *err) guint8 tag_value[6]; guint16 tag; - hdr_info->ieee_802_11.fcs_len = 0; /* no FCS for 802.11 */ + hdr_info->ieee_802_11.fcs_len = 0; /* assume no FCS for 802.11 */ /* Extract the fields from the packet header */ do { @@ -365,6 +365,10 @@ airopeekv9_process_header(FILE_T fh, hdr_info_t *hdr_info, int *err) hdr_info->timestamp.upper = pletohl(&tag_value[2]); break; + case TAG_AIROPEEK_V9_FLAGS_AND_STATUS: + /* XXX - not used yet */ + break; + case TAG_AIROPEEK_V9_CHANNEL: hdr_info->ieee_802_11.channel = pletohl(&tag_value[2]); break; @@ -461,10 +465,21 @@ static gboolean airopeekv9_read(wtap *wth, int *err, gchar **err_info _U_, case WTAP_ENCAP_IEEE_802_11_WITH_RADIO: /* * The last 4 bytes sometimes contains the FCS but on a lot of - * interfaces these are zero. To eleminate problems we reduce - * the length by 4. + * interfaces these are zero. Is there some way to determine + * from the packet header whether it's an FCS or not? * - * XXX - is there any way to find out whether it's an FCS or not? + * For now, we just discard those bytes; if we can determine + * whether it's an FCS or not, we should use that to determine + * whether to supply it as an FCS or discard it. + */ + wth->phdr.len -= 4; + wth->phdr.caplen -= 4; + break; + + case WTAP_ENCAP_ETHERNET: + /* + * The last 4 bytes appear to be 0 in the captures I've seen; + * are there any captures where it's an FCS? */ wth->phdr.len -= 4; wth->phdr.caplen -= 4; -- cgit v1.2.3