Re: “bytes on wire” vs. “bytes captured”

[Guy Harris <guy () alum mit edu>]

On Jul 19, 2019, at 9:30 AM, Jasper Bongertz <jasper () packet-foo com> wrote:

> so if I get this right you expect to end up with a frame where length of the original
> content is less than what ends up in the pcap because meta data is added? This
> usually happens by adding a trailer to the Ethernet frame,

Not necessarily.  See the examples I gave, in which case it's done by adding a header to the frame.

> If you have a capture device that wants to write additional detail about a frame
> to the capture file you should choose pcapng instead.

Or choose a different link-layer header type, which works with pcap or pcapng, as per the examples I gave.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe