Wireshark · Ethereal-dev: [Ethereal-dev] What link-type value do I need to feed for ethrreal to display the IP, ICMP and TCP/U

["Viren" <viren.s@xxxxxxxxxx>]

Could you please help me in solving my technical query on ether-real?

 

I am trying to "create" a binary tcpdump file compatible with the LibPCap file format. I want to display the IP header, ICMP header and the TCP/UDP header of every incoming-outgoing packet.

 

For the above, I am using the link-type (the last 4 bytes of the tcpdump file-header) to be 101 (which I got from the savefile.c of WinPCap). That number, is really for Raw IP and not the one I want.

 

Questions:

1. What value should I write in my binary file for the link-type so that etherreal would display me the IP header, ICMP, TCP/UDP headers ?

 

2. Is it that I will have to separate the incoming packet and break it into IP, TCP/UDP and then create separate record headers from them and dump the stuff in the tcpdump file as separate records? Or simply dumping the entire packet (with perhaps a proper link-type being set) should do the trick for me?

 

I tried posting my message at the forum but I am not quite sure why my posts are not appearing in the forum.

 

Looking forward for your help.

 

Kind regards,

Viren