[Coral-dev] SNAP header

[David Moore]

On Tue, Mar 04, 2003 at 01:05:50AM -0500, Steve Bernard wrote:
> It seems that the SNAP header is causing me to lose several bytes of L4 
> data. I am currently using FORE-200E's so it's either 48-bytes or 
> everything. My capture and storage requirements make the 'everything' 
> impractical but, losing the L4 data makes the captures much less useful. 
> Am I missing something, or is this something that will require some 
> development with Perl and CRL.pm?

If your network has an LLC/SNAP header at the front of packets
there is nothing you can do about that if you can only capture the
first cell.  The first ATM cell only has 48 bytes, which includes
that header.  Your other choice is to capture everything, but only
write out part of what you see, for example changing crl_to_pcap
to truncate packets at whatever length you desire.

-- david