Wireshark-bugs: [Wireshark-bugs] [Bug 3961] Can't convert from .pcapng to .pcap with versions 1.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3961
--- Comment #4 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-11-24 06:04:16 PST ---
(In reply to comment #3)
> What happens if the pcap-ng file has *two* Interface Description Blocks - one
> for LINKTYPE_ETHERNET and one for LINKTYPE_IEEE802_11? Neither
> WTAP_ENCAP_ETHERNET nor WTAP_ENCAP_IEEE_802_11 would be valid encapsulation
> types - only WTAP_ENCAP_PER_PACKET would be valid.
I don't think Wireshark or capinfos are equipped to handle that, are they? In
this case, what would they display for encapsulation, "unknown"?
Also, editcap, to my knowledge, is not equipped to handle multiple
encapsulations, is it? "-T unknown" doesn't work.
And if you're trying to convert from pcapng to pcap, then pcap itself doesn't
support multiple encapsulations either, so no matter what, this is going to
fail.
So ... what do you suggest? Do I keep searching for all IDB's and if more than
one is found, then set the file_encap to 0 (i.e., "unknown")? That will end up
causing the conversion from pcapng to pcap to fail since that was what was
happening initially, but either way the conversion is going to fail. Is it
better to fail that way than later on when, for example, "ieee-802-11"
encapsulated packets are incorrectly attempted to be converted from pcapng to
pcap assuming "ether" encapsulation?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
