Wireshark · Ethereal-users: Re: [Ethereal-users] TCPdump format

[Guy Harris <guy@xxxxxxxxxxxx>]

On Friday, July 11, 2003, at 11:30 AM, Niels Steenberg wrote:

> I am trying to write an application to post process the data captured 
> by
> Ethereal in the TCPDUMP format, but I need a specification of the file
> format. Where can I dinf it in order to read the file with my 
> application?

If you write your application to use the libpcap library to read the 
capture file (which is what tcpdump uses), you can read the data 
*without* a specification of the file format (a file format that, at 
some point, may change to add new capabilities - updated versions of 
libpcap will read the old and new formats, so all you'd have to do to 
handle the new format would be to relink if your application is 
statically linked with libpcap or install a new library if it's 
dynamically linked with libpcap).