https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6483
--- Comment #6 from Guy Harris <guy@xxxxxxxxxxxx> 2011-10-25 16:52:51 PDT ---
Reverse-engineered so far:
Each packet has a record header that consists of:
a 2-byte little-endian record length, the value of which does *NOT* include
the record length field itself;
a 1-byte as-yet-unknown value;
a 4-byte little-endian time stamp, in milliseconds since some as-yet-unknown
time (probably the start of the capture, which is probably recorded in the file
header);
a 1-byte flag field, the low-order bit of which is 1 for user-to-network
(TE-to-NT) traffic and 0 for network-to-user (NT-to-TE) traffic, and the other
bits of which are as-yet-unknown.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
