Wireshark-users: Re: [Wireshark-users] network monitor 3.4 traces cannot be read
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Graham Bloice <graham.bloice@xxxxxxxxxxxxx>
Date: Fri, 23 Jul 2010 12:39:53 +0100
On 23/07/2010 11:19, Guy Harris wrote: 
On Jul 23, 2010, at 12:34 AM, Graham Bloice wrote:


Here's my capture.  Captured on Win 7 x64 Pro with NM 3.4 (3.4.2350.0).  Tried to load in to Wireshark x64 1.5.0-SVN-33615 with the error I reported previously.  The capture has DNP3 traffic on port 2000 captured on a PPTP VPN.

OK, the per-file link-layer type for the file is 1, meaning Ethernet, but the per-packet link-layer type for most of the packets is 0.  That's probably a quirk either of VPN captures or general PPP captures.

I've checked into the trunk and 1.4 branches a change to treat a link-layer type of 0 as Ethernet; that allows it to read your capture.
As expected that fix is good for me with 1.5.0-SVN-33620.
-- 
Regards,

Graham Bloice