Ethereal-users: [Ethereal-users] Re: pcap: network type 15 unknown or unsupported
woohoo
even TCP sequence graphs works on that capture,
now if i only can get a capture with tcp over something over tcp
everything would be even better.
On 7/5/05, Guy Harris <gharris@xxxxxxxxx> wrote:
> diaz_d1@xxxxxx wrote:
> > Can yop open this file?
>
> I can extract the capture file from the ZIP file.
>
> Unfortunately, the capture file is probably in Nokia's stupid format, in
> which they modified the per-packet header to add an extra 4-byte field
> but DIDN'T CHANGE THE MAGIC NUMBER, so an application such as Ethereal
> can tell the difference between normal libpcap files and Nokia libpcap
> files by trying to see whether it can successfully read part or all of
> the file assuming it's a regular file and, if not, trying to see whether
> it can do so assuming it's a Nokia file. (Unfortunately, some other
> capture file formats *also* use the standard magic number, so the
> heuristics are a bit more complicated than that.)
>
> The current heuristics for detecting Nokia files in Ethereal only check
> if the link-layer type value is 13, which they use for ATM; I tried
> adding a check for 15, but apparently the heuristics succeed for the
> first two packets, which is all Ethereal currently tries - perhaps it
> should try 3 packets, which it appears should be enough to tell the
> difference between the two file types.
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
