Wireshark-dev: Re: [Wireshark-dev] Packet Storage
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Tue, 08 Mar 2011 09:58:11 -0500
Tharaneedharan Vilwanathan wrote:

Hi All,

I have a quick question.

The .pcap format allows the packets to be of the same ethernet type,
right? If so, what is the best way to store the packets of different
ethernet types in a file?

Sorry if this is a common question and/or this has been asked already.
Different file types allow different things. PCAP files can contain only one DLT value.
PCAP-NG files, OTOH, support multiple link types in a given file. Wireshark has some basic support for them. For more info see: 

http://wiki.wireshark.org/Development/PcapNg
I believe there are other file types that Wireshark supports that support multiple link types.