Wireshark-dev: Re: [Wireshark-dev] [tcpdump-workers] Which versions of pcap files accept pcap_o
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 11 Mar 2008 15:11:32 -0700

On Mar 11, 2008, at 1:15 PM, Stephen Donnelly wrote:


When you save a capture in libpcap format Wireshark doesn't prompt you
for which DLT to use?


No.  That's supposed to happen automatically.


How does it decide which DLT is appropriate?
It decides based on the encapsulation type of the input file, e.g. if the input file has an encapsulation type of WTAP_ENCAP_ETHERNET (as, for example, a libpcap file with DLT_EN10MB would have), Wireshark would open the output file with that encapsulation type, which the libpcap-writing code would map to DLT_EN10MB.