When a pcap file uses one of the user DLTs (147 to 162) wireshark uses this table to know which protocol(s) to use for each user DLT.
This table is handled by an Section 10.7, “User Table” with the following fields.
- DLT
- One of the user dlts.
- Payload protocol
- This is the name of the payload protocol (the lowest layer in the packet data). (e.g. “eth” for ethernet, “ip” for IPv4)
- Header size
- If there is a header protocol (before the payload protocol) this tells which size this header is. A value of 0 disables the header protocol.
- Header protocol
- The name of the header protocol to be used (uses “data” as default).
- Trailer size
- If there is a trailer protocol (after the payload protocol) this tells which size this trailer is. A value of 0 disables the trailer protocol.
- Trailer protocol
- The name of the trailer protocol to be used (uses “data” as default).