Wireshark · Ethereal-dev: Re: [Ethereal-dev] Flexible file formats

[Guy Harris <gharris@xxxxxxxxxxxx>]

On Sat, Dec 23, 2000 at 12:25:11PM -0600, Gilbert Ramirez wrote:
> As a side note, the current version of the pcap file format should work
> just fine for you, but if for some reason you need to change the format of
> the headers of the file or its records, be sure to coordinate with
> tcpdump-workers,

The same applies if you need to add a new link-layer type.

(There's a fair bit of hackery, both in the current CVS version of
libpcap and in Wiretap's libpcap support, to cope with the fact that
different OSes have given different link-layer types the *same*
numerical value, making it a bit difficult to read some captures on a
platform other than the one on which the capture was done.  I hope to
avoid having to continue to add table entries to cope with that....)