Hello,
On Sat, 2007-01-20 at 11:10 -0500, Charles Lepple wrote:
> It doesn't look like this dissector has any preferences registered
> yet. Would anyone object to a patch that adds a preference for
> byte-swapping? (The default could be set to match the current
> behavior.)
Things are evolving on the libpcap side. The kernel interface for usb
sniffing has been recently updated, and the libpcap interface has been
changed accordingly.
The current status is:
The linux kernel provides two events for each exchanged URB (one on URB
submission and the second on URB transfer completion). Each event
contains a linux specific header (this header is quite different from
the old one used by libpcap) in host byte order and eventually is
followed by the setup header and usb data, in little endian byte order.
The (new) libpcap interface keep this aligment: host byte order for usb
header and little endian for all the rest. To ensure that the linux
header is in host byte order, byte swapped is performed as required when
reading packets from dumps.
While this design isn't probably the must beautiful one, it allows
libpcap to take advantage of the new memory mapped access to the usb
data, for hi-speed URB sniffing.
I'm currently working to update the wireshark dissector to use this new
interface. The update will require some changes to the wiretap library,
to be consistent with libpcap.
Best regards,
Paolo
--
Email.it, the professional e-mail, gratis per te: http://www.email.it/f
Sponsor:
Refill srl il paradiso della tua stampante - cartucce e toner compatibili, inchiostri e accessori per la ricarica, carta speciale. Tutto a prezzi scontatissimi!
Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=5187&d=22-1
