Wireshark · Ethereal-users: Re: [Ethereal-users] comparing two files

[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:
> perl's Net::Pcap  and NetPacket can turn out much more useful for that purpose,

I.e., to answer the original question, "Ethereal's file structure" is 
just libpcap format, as used and generated by tcpdump and a number of 
other programs as well; libpcap obviously can read and write that file 
format.

That means that there's no structure to the packet data itself - there's 
just a raw blob of bytes.