Wireshark-dev: [Wireshark-dev] writing non-Ethernet pcapng files
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Aaron Turner <synfinatic@xxxxxxxxx>
Date: Thu, 21 May 2009 11:44:18 -0700
I noticed that 1.0.x versions of wireshark don't support writing
non-Ethernet pcapng files.  However, other then explicitly forbidding
it in pcapng_dump_can_write_encap() in wiretap/pcapng.c I can't see
any reason for this- the link_type field seems to be correctly
read/written.

I commented out the check, and did a test (Cisco HDLC) and had no
problem reading a standard pcap file and converting it to pcapng.

Am I missing something?

-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin