Ethereal-dev: Re: [Ethereal-dev] mergecap patch: dissimilar frame encapsulation types

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 14 Jul 2001 12:36:15 -0700
On Sat, Jul 14, 2001 at 12:10:35AM -0700, Scott Renfro wrote:
> Here's the updated patch to mergecap.

Checked in.

> One thing I noticed in testing it: for file types that have an
> XXX_dump_can_write_encap(), XXX_dump_can_write_encap always appears to
> return unsupported when the type is per-packet.

That's because the only capture file types that have an
"XXX_dump_can_write_encap()" routine are the ones for which code to
write that capture file type has been written, namely libpcap, Microsoft
Network Monitor, NetXRay (and Sniffers that use NetXRay-based formats),
Sniffer Classic, and Sun's snoop, and none of those capture file types
support (unless I've missed something) capture files with per-packet
encapsulation types.

The only ones that we read that *do* support per-packet encapsulation
types are

	Etherpeek;

	i4btrace for BSD;

	iptrace for AIX;

	the Toshiba TR-600 and TR-650's "snoop" command's text output;

but nobody's written code to write those formats.