Re: Packet Storage

[Guy Harris <guy () alum mit edu>]

On Mar 8, 2011, at 2:06 AM, Tharaneedharan Vilwanathan wrote:

> The .pcap format allows the packets to be of the same ethernet type,
> right? If so, what is the best way to store the packets of different
> ethernet types in a file?

The pcap format requires that all packets have the same type of *link-layer header*.  That means, for example, that you 
couldn't mix Ethernet packets, with an Ethernet header, and Wi-Fi packets, with an IEEE 802.11 header in the same file 
- or even mix Wi-Fi packets with just an 802.11 header and Wi-Fi packets with a radiotap header followed by an 802.11 
header in the same file.

However, if by "Ethernet type" you mean the type/length field in the Ethernet header, you *can* have Ethernet packets 
with multiple Ethernet types in a pcap file - as far as the pcap file format is concerned, they're all Ethernet 
packets; if some of them are IPv4 packets with an Ethernet type of 0x0800, and some of them are ARP packets with an 
Ethernet type of 0x0806, and some of them are IPv6 packets with an Ethernet type of 0x86dd, and some of them are Novell 
IPX packets with an Ethernet type of 0x8137, and others have a length value rather than a type value, that's not a 
problem.
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe