OK, I've been able to reproduce the issue. It actually doesn't depend on
whether I'm using 0.9.4 or 0.9.7 but on the particular capture file I'm
trying to open. Some files open normally; for others, I get error "snoop:
network type 10 unknown or unsupported".
Attached are 2 files (generated using the same Optiview device), one which
opens OK, the other for which I get the error.
********************
Olivier Kurzweg
DSIT-T/Equipe LAN
tel: 301078 ou 0156330322
mob: 0664090436
mail: ext.siticom.kurzweg@xxxxxxx
> -----Message d'origine-----
> De: Guy Harris [mailto:gharris@xxxxxxxxx]
> Date: mercredi 4 décembre 2002 18:00
> À: EXT / SITICOM KURZWEG
> Cc: 'ethereal-users@xxxxxxxxxxxx'
> Objet: Re: [Ethereal-users] unsupported Ethernet type 10
>
>
> On Wed, Dec 04, 2002 at 01:01:54PM +0100, EXT / SITICOM KURZWEG wrote:
> > Did the capture file import filters
>
> They're not really "filters" - we read all file formats in
> the same fashion,
> regardless of whether they're libpcap format (Ethereal's
> native format)
> or not.
>
> > changed between 0.9.4 and 0.9.7?
>
> At least some of the capture file reading modules changed
> between 0.9.4
> and 0.9.7.
>
> > With
> > version 0.9.7, Ethereal is complaining about an unsupported
> Ethernet type 10
> > and refuses to open my capture files.
> >
> > I'm using an Fluke Networks probe (Optiview) to make
> captures on a network.
> > Those captures are saved as .cap files...
>
> At least two different capture file formats use ".cap" as the suffix
> (Microsoft Network Monitor, and "NetXRay", which is what NetXRay used
> and the Windows version of the Sniffer code uses), so "as .cap files"
> doesn't specify the format. There may be other formats where
> ".cap" is
> used as well.
>
> We'd need to know which one of them the Optiview captures are
> saved as;
> neither the NetXRay reader nor the Network Monitor reader appears to
> have changed between 0.9.4 and 0.9.7 in such a fashion as to cause a
> problem with an "unsupported Ethernet type 10". What was the *exact*
> text of the message printed or displayed when it failed to open the
> file? (If you're doing this on UNIX, and you run Ethereal from a
> terminal window such as an xterm, it should print the message on the
> terminal window; on Windows, it might pop up a console window in which
> to display the message.) That message should say something such as
> "XXX: network type 10 unknown or unsupported", with "XXX" being
> something such as "netmon" or "ngsniffer" or "netxray".)
>
Attachment:
pkts_01-06-99_00_20.cap
Description: Binary data
Attachment:
pkts_01-06-99_02_04.cap
Description: Binary data
