Wireshark · Ethereal-dev: Re: [Ethereal-dev] source code for observer file format

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 30, 2003, at 10:29 AM, Scott Emberley wrote:

> Could you add the following files to the source tree.

Checked in, with fixes to handle the byte-order and C++-comment issues, 
and the relevant changes to file_access.c, wtap.h, Makefile.am, and 
Makefile.nmake; I left the guint64 stuff in, as some dissectors (e.g., 
RSVP) are using it unconditionally.  If nobody complains about 0.9.16, 
we should perhaps treat that as an indication that we can, by and 
large, safely use guint64 (although we can *NOT* use %ll{d,o,u.x} to 
print 64-bit integers - *printf on most UNIXes supports it, but that's 
not the case with all UNIXes, and *printf on Windows uses something 
else).

> I have been give the OK to add writing to this format once this source 
> has been posted.

What about support for other link-layer types (802.11, FDDI, WAN) and 
earlier versions of Observer?  (The fact that Ethernet has a link-layer 
type of 0 and Token Ring has a link-layer type of 1 suggests that the 
link-layer type is an NDIS network type value - 1, in which case FDDI 
would be 2.)