Ethereal-users: Re: [Ethereal-users] Ethereal on W2K POS/ATM Captures (alternatively on Linux)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 4 Nov 2002 12:37:48 -0800
On Mon, Nov 04, 2002 at 05:30:13AM -0500, mrmartin1903@xxxxxxxxxxxx wrote:
> For this test I am only using Ethereal to load capture files from a
> third party analyser.

	...

> Attached are one POS capture in ASCII (tcp_cap.txt) and libpcap
> (tcp_cap.eth) format.

Did the third party analyzer write out "tcp_cap.txt", and did you use
"text2pcap" to convert it to libpcap format?

If so, you should have used the command-line option

	-l 9

when you ran "text2pcap", to give the output file a link-layer type of
PPP rather than Ethernet.  "text2pcap" defaults to Ethernet, but if the
capture you're converting isn't an Ethernet capture, the default isn't
what you want (and "text2pcap" can't automatically determine the type of
capture just by looking at it, so you have to override the default
manually).