Wireshark-users: Re: [Wireshark-users] ISDN Layer 3 decode
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 21 Oct 2011 15:45:47 -0700
On Oct 21, 2011, at 2:27 PM, Keith French wrote:

> It does have an Export option to Ethereal, but all packets show up as malformed.

"Ethereal"?  If it really says "Ethereal", it probably dates back before the introduction of the pcap link-layer types LINKTYPE_LAPD etc.; the only pcap encapsulation that a release called "Ethereal" supported (the last release called "Ethereal" was 0.99.0) was LINKTYPE_LINUX_LAPD.

What does capinfos say about the exported-to-Ethereal files?

> It can be saved in its own format (which I would think is highly protected) being a commercial product,

Well, some vendors of commercial network analyzers publish their capture file format, and others don't, but it might be possible to reverse-analyze the format.  Who are the two vendors in question?

> or in CSV or Text. The other analyser I mentioned that uses Wireshark saves its D channel decodes in TRC format.

What's "TRC format"?