Wireshark-dev: Re: [Wireshark-dev] wslua: reading raw file?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 08 Apr 2008 23:59:00 -0700
Németh Márton wrote:


I started to use wslua and succeed to write a simple dissector on
ethernet level. I created a .pcap header and copied my raw file after
it.

Is it possible using wslua to open a raw file which is not supported
by Wireshark, yet?
Creating a libpcap-format file header and writing after it packets that don't have libpcap-format packet headers is a waste of time; if you want to write a file that programs that read libpcap format can read, put the libpcap-format file header at the beginning of the file and then put libpcap-format packet headers in front of the packet data for each packet, and if you just want a raw file, just write out the raw file without the libpcap-format headers - without libpcap-format per-packet headers, the libpcap-format file header won't help you.