Wireshark-bugs: [Wireshark-bugs] [Bug 3961] Can't convert from .pcapng to .pcap with versions 1.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3961
--- Comment #13 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-12-05 12:19:55 PST ---
(In reply to comment #5)
> *Wireshark* - and TShark - are capable of handling WTAP_ENCAP_PER_PACKET, so
> they can handle a pcap-ng file with multiple interfaces with different
> link-layer types.
Guy, are you certain of this? Reading the "Known Limitations" of pcapng, that
would not appear to be the case.
>From http://wiki.wireshark.org/Development/PcapNg:
Known Limitations
* Only a single section
* Only a single interface
* Only Ethernet link type
* Only blocks SHB, IDB, PB, EPB, SPB (others will be ignored)
* Lots of Options not implemented
* Writing files is mostly untested
Since I couldn't find any valid pcapng files with multiple encapsulations I had
tried to manually create one, but Wireshark crashed trying to read it, so as
far as I can tell, those limitations are still applicable. Assuming they are,
I don't think it's worth spending any additional time on this particular bug
than the patch I already submitted. I don't think we need to turn this bug
into one that prescibes fixing/implementing all pcapng limitations. Instead, I
think it makes sense to just fix this bug and leave the task of converting
pcapng from experimental status to fully supported status alone until someone
has the time and desire to spend on it.
Please correct me if I'm mistaken about the level of pcapng support in
Wireshark. Thanks.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
