Ethereal-users: Re: [Ethereal-users] Simultaneously Decoding Packets with different Link Type

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Thu, 15 Sep 2005 16:55:45 -0400


Jeetendra Singh wrote:
<>Is it possible to simultaneously decode packets with different link types using Ethereal? For example if I am providing IP & SS7 packets to Ethereal at the same time, will Ethereal be able to decode them?
The (current) PCAP file format (which I suppose you're using since you're talking about linktypes) does not support having more than one linktype per file. I think there are file formats that do; from the "mergecap(1)" man page: 


     The output file frame encapsulation type is set to the type
     of the input files, if all input files have the same type.
     If not all of the input files have the same frame
     encapsulation type, the output file type is set to
     WTAP_ENCAP_PER_PACKET.  Note that some capture file formats,
     most notably libpcap, do not currently support
     WTAP_ENCAP_PER_PACKET.  This combination will cause the
     output file creation to fail.


Unfortunately that doesn't say which formats _do_ support it.