Re: pcap files with file header snaplen < packet

[Gerald Combs <gerald () wireshark org>]

Harley Stenzel wrote:
> Looking forward, however, it would be helpful if the libpcap file
> format provided a way to tag the source of the captured packet, so
> that merged files do not loose information.

NTAR supports this:

  http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionpb
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.