[pcap-ng-format] The section for the Simple Packet Block should note that the block can have options
Guy Harris
guy at alum.mit.edu
Thu May 10 11:28:43 PDT 2012
As section 2.5 "Options" says "All the block bodies have the possibility to embed optional fields.", the description of the Simple Packet Block in section 3.4 should show options following the Packet Data field, and include Options in the list of fields - and not say that "The length of [the Packet Data] field can be derived from the field Block Total Length, present in the Block Header", as you can't do that if you have options (or padding). It should just say something such as
The amount of packet data is the minimum value among the SnapLen (present in the Interface Description Block) and the Packet Len (present in this header). The length of the Packet Data field is the amount of packet data, rounded up to a multiple of 4 bytes.
More information about the pcap-ng-format
mailing list