Wireshark-users: Re: [Wireshark-users] Question about parsing raw MTP3

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 04 Oct 2006 08:59:56 -0700

Anders Broman wrote:

I think you should use a DLT value of:

	...

#define DLT_MTP3  141                 /* MTP3, without pseudo-header or MTP2 */

He wants his pcap file to have 141 as the link-layer type, to have it interpreted as raw MTP3; if he used, for example, 1, i.e. DLT_EN10MB, Wireshark (and Ethereal, and tcpdump, and...) would interpret the file as Ethernet, as that's what the link-layer type value says it is.

And possibly a

#define WTAP_ENCAP_MTP2    42

#define WTAP_ENCAP_MTP3    43

Those are values used internally in Wireshark, not in files; a pcap link-layer type value of 141 maps to a WTAP_ENCAP value of 43.