Wireshark · Ethereal-dev: Re: [Ethereal-dev] To make ethereal to understand new format file

[Guy Harris <gharris@xxxxxxxxx>]

harsha ss wrote:

> The problems are,
> 1> The hexdump it is displaying is the unknown hexdump alon with the 
> data bytes in the file read.
> 2> I want to know how to make ethereal to understand this without the 
> proper encapsulation type.

Ethereal *cannot* understand packets unless it knows the encapsulation 
type; if it doesn't know the encapsulation type, it doesn't know how to 
interpret the raw packet data.

> 3> I want to know what is exactly the meaning of 'per-packet-encapsulation'

It's used for files where not all of the packets have the same 
link-layer encapsulation, such as, for example, the files from the 
'snoop' command in the Toshiba TR-600 and TR-650 "Compact" ISDN Routers, 
where it contains both packets from the Ethernet side, where the packets 
have an Ethernet header, and packets from the ISDN side, where the 
packets have an ISDN "pseudo-header" and are either LAPD packets for the 
D channel and whatever data is going out on the B channel, such as PPP.

> 4>I want to display the contents of the file read in the summary pane

What do you mean by "the contents of the file read"?