Packet structure

|           Header          |
|         (4 Octets)        |
|           Payload         |
.                           .
.                           .
.                           .


The header field contains a 32-bit value in little-endian byte order.

The low-order 8 bits are a set of error flags for the packet:

  • 0x00000001 - MII RX_ER
  • 0x00000002 - alignment error
  • 0x00000004 - FCS error
  • 0x00000008 - frame too long
  • 0x00000010 - SFD error
  • 0x00000020 - frame shorter than 64 bytes
  • 0x00000040 - preamble shorter than 7 bytes
  • 0x00000080 - preamble longer than 7 bytes

The next bit, 0x00000100, is set if the packet arrived on the GPIO port rather than the Ethernet port.

The next bit, 0x00000200, is set if the packet was received in transparent capture mode. That should never be set for LINKTYPE_NETANALYZER and should always be set for LINKTYPE_NETANALYZER_TRANSPARENT.

The next 4 bits, 0x00003C00, are a bitfield giving the version of the header field; the current version is 1.

The next 2 bits, 0x0000C000, are the capture port/GPIO number, from 0 to 3.

The next 12 bits, 0x0FFF0000, are the frame length, in bytes.

The topmost 4 bits, 0xF0000000, are reserved.

The payload is an Ethernet frame, beginning with the MAC header and ending with the FCS, for LINKTYPE_NETANALYZER, and an Ethernet frame, beginning with the preamble and ending with the FCS, for LINKTYPE_NETANALYZER_TRANSPARENT.