tcpdump mailing list archives
Re: pcap files with file header snaplen < packet
From: "Harley Stenzel" <hstenzel () users sourceforge net>
Date: Mon, 4 Dec 2006 10:03:49 -0500
On 12/1/06, Jefferson Ogata <Jefferson.Ogata () noaa gov> wrote:
Is it possible they were the result of combining multiple pcaps via something like mergecap?
It would seem that for something like this to be generally usefull, a capture station identifier would be needed. I suppose a source-file identifier could also do the trick. Consider multiple captures on multiple stations involving the same connections. Also consider multiple nics on the same host. Without some way of knowing where the capture came from, for many applications a merged capture looses important data. --Harley - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- pcap files with file header snaplen < packet header caplen Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet header caplen Guy Harris (Nov 30)
- Re: pcap files with file header snaplen < packet header caplen Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Nov 30)
- Re: pcap files with file header snaplen < packet Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Dec 04)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Gerald Combs (Dec 04)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Gianluca Varenni (Dec 04)
- Re: pcap files with file header snaplen < packet Guy Harris (Dec 04)
- Re: pcap files with file header snaplen < packet header caplen Guy Harris (Nov 30)
- Re: pcap files with file header snaplen < packet Aaron Turner (Dec 04)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Dec 05)
- Re: pcap files with file header snaplen < packet Aaron Turner (Dec 05)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Dec 05)