Wireshark · Wireshark-dev: Re: [Wireshark-dev] wslua: reading raw file?

[Németh Márton <nm127@xxxxxxxxxxx>]

Guy Harris wrote:
> Németh Márton wrote:
> 
>> I started to use wslua and succeed to write a simple dissector on
>> ethernet level. I created a .pcap header and copied my raw file after
>> it.
>>
>> Is it possible using wslua to open a raw file which is not supported
>> by Wireshark, yet?
> 
> Creating a libpcap-format file header and writing after it packets that 
> don't have libpcap-format packet headers is a waste of time; if you want 
> to write a file that programs that read libpcap format can read, put the 
> libpcap-format file header at the beginning of the file and then put 
> libpcap-format packet headers in front of the packet data for each 
> packet, and if you just want a raw file, just write out the raw file 
> without the libpcap-format headers - without libpcap-format per-packet 
> headers, the libpcap-format file header won't help you.

I don't really understand your point, maybe I did not describe well what
I would like to do. I would like to write a dissector which is similar to
how Wireshark can open .mp3 files. The .mp3 files don't have libpcap headers
at all, but Wireshark can handle them.

My question is that is it possible to create a dissector which reads a
raw file without libpcap header?

	Márton Németh