Since PCAP has general applicability to packet capture, it made sense to provide a vendor-neutral, generic view of Bluetooth capture. However, the preference was to have separate DLT’s for BR/EDR baseband and LE link-layer (as per the terms used in the Bluetooth spec). It was possible, and somewhat consistent with DLT_BLUETOOTH_HCI_H4_WITH_PHDR, to allocate a single DLT_BLUETOOTH_LOW_LEVEL to indicate any Bluetooth capture (BR/EDR or LE). Now that the DLTs are allocated, and this article serves to collect implementation alternatives and details. Early versions of this article formed a place to collect such a proposal. Best practice is to allocate a DLT for a particular link-layer and define a pseudo-header for that DLT that precedes each packet in the file. The pcapng format also uses these same link types and the per-packet formatting as PCAP.Įarly versions of libbtbb and ubertooth saved PCAP files with the DLT_PPI format, which was expedient but is considered deprecated by the libpcap folks. Classic PCAP files store a sequence of packets of a single link type.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |