Re: [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

[Guy Harris <[e-mail]>]

On Dec 22, 2020, at 1:01 AM, Guy Harris <[e-mail]> wrote:

> They were originally intended for use with some stuff NetBSD was doing (I'd have to look into the history of the NetBSD code), but I think NetBSD stopped doing that.

The commit message for the change that added the macros was:

commit afbb1ce7227dc5edb291f242ed8d95cd3762fc51
Author: Guy Harris <[e-mail]>
Date:   Sat Sep 29 19:33:29 2007 +0000

    Based on work from Florent Drouin, split the 32-bit link-layer type
    field in a capture file into:
    
            a 16-bit link-layer type field (it's 16 bits in pcap-NG, and
            that'll probably be enough for the foreseeable future);
    
            a 10-bit "class" field, indicating the group of link-layer type
            values to which the link-layer type belongs - class 0 is for
            regular DLT_ values, and class 0x224 grandfathers in the NetBSD
            "raw address family" link-layer types;
    
            a 6-bit "extension" field, storing information about the
            capture, such an indication of whether the packets include an
            FCS and, if so, how many bytes of FCS are present.

So what NetBSD had was a convention where a capture file could have a link-layer type that combined an AF_ value with some additional bits to distinguish the value from a regular LINKTYPE_ value; I don't know what AF_ values they supported for that, or where that code was, or whether it's still supported.