Ethereal-users: Re: [Ethereal-users] pcap: network type 15 unknown or unsupported
diaz_d1@xxxxxx wrote:
i'm trying to read a file with Ethreal 0.10.11 (Win version) but I get that
error "pcap: network type 15 unknown or unsupported. The file was captured
with tcpdump version 3.3, aditional data about interface is:
vpp0c0: lname vpp0c0
flags=4f<UP,PHYS_AVAIL,LINK_AVAIL,POINTOPOINT,MULTICAST> encaps chdlc
inet mtu 1500 unnumbered (loop0c0)
loop0c0: lname loop0c0
flags=57<UP,PHYS_AVAIL,LINK_AVAIL,LOOPBACK,MULTICAST>
inet6 mtu 63000 ::1 --> ::1
inet mtu 63000
inet 127.0.0.1 --> 127.0.0.1
inet 10.200.0.21 --> 10.200.0.21
I did:
tcpdump -i vpp0c0 -s 4096 -w LinkPoCal.cap
Physical interface is ATM, vendor is Nokia and I'm trying to watch
datagrams about 10.200.0.21 address.
Could anybody tell me if is it possible to use Ethereal with this file?
If I could determine the link-layer header that appears in the file
(NOTE: there is *NOT* always a simple correlation between the type of
interface on which the file was captured, due to various additional
headeers being added, link-layer headers being removed, headers being
transformed, etc.), I could suggest a command that would read the file
and write it out with a different link-layer type number.
15, unfortunately, is a type that means different things on different
platforms, due to a lack of central coordination for assignment of
values to link-layer types (which is why anybody who wants a link-layer
type should now go through tcpdump.org - before tcpdump.org existed,
people often just picked the "next available" number, and unfortunately
that meant that different people would pick the same number for
different purposes). That's why Ethereal doesn't support it.
(See attached file: LinkPoCal.rar)
I did, but the only software on my machine I know of that can handle
.rar files - Stuffit Expander - gave an error.
Could you just send LinkPoCal.cap as a binary attachment?
