Wireshark · Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13

[Guy Harris <guy@xxxxxxxxxxxx>]

On May 2, 2013, at 9:25 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:

> Alternatively if the file is rewritten on the first pass writing the reassembled data together with the packet holding the last fragment the reassembled data could be read together with the packet
> But that might have other problems and might require changes to the file format description (pcap-ng)

Not all capture files are pcap-ng files.

Not all the capture files that aren't pcap-ng files are pcap files.

Not all the capture files that are neither pcap-ng files nor pcap files have link-layer header types supported by pcap or pcap-ng.

Anything that assumes that capture files are all pcap or pcap-ng won't work.