On Feb 11, 2004, at 2:02 AM, Gianluca Varenni wrote:
WinPcap does not strip any byte from packets. Since they do not contain
valid data (FFFF) I think it's some sort of frame tail used by the etherpeek
capturing engine (just my opinion, of course).
It's probably something such as that. Ethereal can read both libpcap-format captures and various of the capture formats from {Ether,Airo}Peek; sometimes *Peek puts 4 bytes of 0 at the end of the packet, and other times it appears to put a packet FCS there.
I don't know why those 4 zero bytes are there when it's not an FCS, unless they did that so that there's *always* 4 "extra" bytes at the end, perhaps simplifying the code path for processing packets in *Peek.
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
