Re: pcap files with file header snaplen < packet

["Harley Stenzel" <hstenzel () users sourceforge net>]

On 12/4/06, Gerald Combs <gerald () wireshark org> wrote:
> Harley Stenzel wrote:
> > Looking forward, however, it would be helpful if the libpcap file
> > format provided a way to tag the source of the captured packet, so
> > that merged files do not loose information.
>
> NTAR supports this:
>
>   http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionpb

It certainly does, but it expired more than 2 years ago.  Is it still active?

--Harley
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.