Attached is splitcap, a program for splitting capture files into
separate files.
There are a few issues:
1. I haven't been able to test the support (meaning "skipping over
them") for the IPv6 extension headers specified in RFC 2460
(Hop-by-Hop Options, Routing (Type 0), Fragment and Destination
Options). If anyone could test splitcap with these headers, and/or
provide a sample capture file, that would be great. Also, we need
to check that splitcap gracefully handles fragmented IPv6 packets
when splitting by TCP/UDP port number (see the BUGS section of the
man page).
2. I nicked the definition of TIME_T_MAX from packet-smb.c. This
splendid preprocessor code should go into a .h file somewhere,
but I haven't given any thought as to where.
3. I had to include a dummy mtp3_addr_to_str_buf() routine in
splitcap.c. Splitcap uses some epan routines and includes
epan/libethereal.a. epan/to_str.c refers to mtp3_addr_to_str_buf()
which is outside epan, and trying to include the real routine
caused an explosion of unresolved references. ISTM the fundamental
problem is that mtp3_addr_to_str_buf() is outside epan and so
libethereal isn't self-contained.
4. Although I've provided patches to, or written, the following
files, I have no facilites to test these:
Makefile.nmake
doc/Makefile.nmake
debian/ethereal-common.files
debian/ethereal-common.manpages
image/Makefile.nmake
image/splitcap.rc.in
packaging/nsis/Makefile.nmake
packaging/nsis/ethereal.nsi
Graeme Hewson
Attachment:
splitcap.tar.gz
Description: application/gzip
