Wireshark · Wireshark-dev: Re: [Wireshark-dev] [ntar-workers] Extending Wireshark libpcap format support, or start using pcapng

[Ulf Lamping <ulf.lamping@xxxxxx>]

Gerald Combs schrieb:
> Pekka Pietikainen wrote:
>   
> > Oh. If you add a new DLT_ value, having it in a way that is extensible
> > + has a way of saying "Here's the raw packet data. It's plain old
> > DLT_EN10MB". And the next one might be 802.11 and the next one 802.11 with 
> > a radiotap header. 
> >     
Ugliest hack I've seen for a quite a while ;-)
> The Per-Packet Information header (PPI) does exactly that:
> http://www.cacetech.com/documents/
Hmmm, after I took a deep look at the pcapng format I guess this would 
be the way to go for me. As it contains all stuff that I need (and some 
optional stuff that I don't need to implement as a first step) ;-)

There are things that PPI is missing, e.g. meta information if captured 
from more than one capture interface (which is one of the things I need 
first).

I see that bringing pcapng to life in Wireshark will be some effort to 
do. However, I tend to do things right so I can build on that cleanly.


So what's the state of pcapng? The spec seems ok, at least for the parts 
I'm interested in. Is there a "real world" implementation (except for 
the ntar library, which is low level "only")? Are there some example 
capture files somewhere?

Regards, ULFL