Wireshark-bugs: [Wireshark-bugs] [Bug 7381] pcapng - mergecap generates unusable file if interfa
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7381
--- Comment #10 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-07-11 10:11:04 PDT ---
(In reply to comment #8)
> So one alternative would be to merge all interfaces that have the same
> link-layer type and the same values for all options. This could, in theory,
> result in interfaces that *shouldn't* be merged being merged anyway; adding an
> additional IDB option for the host name of the machine on which the capture is
> being done (if you're doing an rpcap or other remote capture, this would be the
> name of the machine running the capture program, *not* the remote machine with
> the interface - that machine's host name would be in the interface name, as
> that would be the URL used) would probably prevent most if not all of those.
The IDB:
https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionidb
also is allowed to contain the MAC and/or IPv4 and/or IPv6 addresses of the
interface. The MAC, in particular, should be a pretty good way to uniquely
identify an interface. (No, it wouldn't work for localhost and it's much less
unique for VMs, but...)
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
