Wireshark-bugs: [Wireshark-bugs] [Bug 12504] Loopback capture has both Ethernet and loopback int
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 09 Jun 2016 19:11:35 +0000

changed bug 12504


What Removed Added
Status UNCONFIRMED INCOMPLETE
Summary Saved pcapng file cannot be read by libpcap Loopback capture has both Ethernet and loopback interfaces
Ever confirmed   1

Comment # 1 on bug 12504 from 
Yes, the current APIs in libpcap *require* that all interface description
blocks in a pcapng file have the same link-layer header type; allowing libpcap
to read files with multiple link-layer header types would require a completely
new set of APIs for reading capture files.

OS X's libpcap has (undocumented) APIs of this sort (the code for which can't
be used in standard libpcap, as it's licensed under the APSL, which has patent
clauses that could cause some systems that ship libpcap to reject a version
with that code), so the tcpdump in newer versions of OS X *can* read that file.
 However, programs written to use the standard APIs can't read them.

So the problem is that the capture has more than one IDB in it.  How was that
capture done?  What program was used to capture the traffic?  What interface or
interfaces were used?  If, for example, you captured it with the tcpdump that
comes with newer versions of OS X, and specified the "any" device, it may well
have IDBs for both the en0 device and the lo0 device, and therefore be
inherently unreadable by standard libpcap.

You are receiving this mail because:
  • You are watching all bug changes.