I was wondering about the HDLC.cap file.

According to my references the HDLC is structured as follow:

Flag (1 byte)| Address (1 byte)| Control (1 byte)| Type (2 bytes)| Data (n bytes)| FCS (4 bytes)

However, when I look at the HDLC.cap capture file I see:

Address (1 byte) | Protocol(2 bytes)

I wonder how the two things fit together ?

I don't know much about HDLC, but it seems that the flag and FCS fields are absorbed by the hardware controller and never passed up to the software (similar to the preamble and FCS fields in an Ethernet frame).

Also, Wireshark actually shows the HDLC header as four bytes in length; seems like it just ignores the control field, at least in this instance.