ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] NetXRay 2.2 fileformat

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 17 Aug 2007 13:11:16 -0700
Stig Bj�rlykke wrote:

They are at the end of each frame.

Looks like the same sort of stuff we've seen in other captures.

I checked in a change to make the code that handles LAPB packets do the same check for two bytes in the record header to decide whether there's 4 bytes of junk at the end of the packet that we do for other types. That seems to fix the capture you sent, at least; try it on other captures.

Anybody else with Windows Sniffer X.25 captures should also check this, to see if it breaks anything.

Sometimes they have data and sometimes they are only zero's, so it may be junk.

Do the first 16 bits of the data look, in some packets, as if they're random enough that they might be an FCS?