What is the structure of the netANALYZER NG packet footer as displayed in Wireshark?

What is the structure of the netANALYZER NG packet footer as displayed in Wireshark?

Packet structure

+---------------------------+
|           Payload         |
.                           .
.                           .
|                           |
+---------------------------+
|          footer           |
|  (NETANA_PACKET_INFO_T)   |
|                           |
+---------------------------+

Footer in a C like structure

#pragma pack(1)
typedef struct {
    uint16_t usVersion;             /* represents current packet info structure */
    int64_t  llTimestamp1;          /* timestamp1, content depends on bTimestamp1Type */
    int64_t  llTimestamp2;          /* timestamp2, content depends on bTimestamp2Type */


    uint8_t  bTimestamp1State;      /* state of timestamp1 */
    uint8_t  bTimestamp1Type;       /* type of timestamp1 */
    uint8_t  bTimestamp2State;      /* state of timestamp2 */
    uint8_t  bTimestamp2Type;       /* type of timestamp2 */


    uint8_t   bPacketType;      	/* representation of the packet structure itself */
    struct {
        uint32_t ulPart1;
        uint32_t ulPart2;
        uint8_t  bPart3;
        uint8_t  bPart4;
    } tSrcId;                       /* capture device identifier, content depends on PacketType */

    int64_t   llId;                 /* identification number, -1 if unused (e.g. when this is a netANALYZER frame) */
    uint64_t  ullPayloadState;      /* payload validation state, content depends on PacketType */
    uint8_t   bPayloadType;         /* payload data type*/

    uint32_t  ulPayloadSize;        /* size of data field in byte */
} NETANA_PACKET_INFO_T;
#pragma pack()

Description

Payload

The Payload is the captured packet data.

Its length is determined by NETANA_PACKET_INFO_T.ulPayloadSize. 

Footer structure

The structure is packed resulting in a size of 54 Bytes.

The usVersion field indicates which version of this structure is used

    0x0c00:     current version value

llTimestamp1 and llTimestamp2 are application-specific and depend on bTimestamp1Type and bTimestamp2Type.

bTimestamp1State and bTimestamp2State are both unused.

bTimestamp1Type and bTimestamp2Type describes the type of llTimestamp1 and llTimestamp2 respectively.

    0x00:       timestamp is unused
    0x01:       timestamp for payload in ns, UTC UNIX time since 1.1.1970
    0x02:       duration of interframe gap in ns

The bPacketType signifies how the payload and NETANA_PACKET_INFO_T needs to be interpreted.

    0x00:       GPIO event
    0x01:       netANALYZER legacy frame
    0x02:       Ethernet
    0x03:       mPacket
    0x04:       PROFIBUS frame
    0x05:       IO-Link frame
    0x21:       buffer state

The tSrcId structure contains identifiers for source device, source TAP identifier, and source port number and depends on bPacketType.

For bPacketType 0x00 to 0x05 and 0x21 their meaning is defined as following:

For PacketType 0x00, 0x02 to 0x05 and 0x21

For PacketType 0x01

The llId field is the identifier number

    -1:         if unused (default for netANALYZER legacy frames)
 FIFO / Buffer identifier when indicating a buffer state

The ullPayloadState field describes the payload validation state. Its content depends on bPacketType.

For PacketType 0x00

      0:         detected rising edge

      1:         detected falling edge

For PacketType 0x02 and 0x03

For PacketType 0x21

      0:         buffer overflow

      1:         buffer recovery

For PacketType 0x01, 0x04 and 0x05 this filed is set to 1.

bPayloadType describes the datatype of the payload. For captured frames the value defaults to:

    0x05:       octet string

Other values are reserved and will not appear in pcap or pcapng files.

ulPayloadSize is the size of the payload in bytes without the size of the NETANA_PACKET_INFO_T structure. It is by design the last field of the structure.