Wireshark-users: Re: [Wireshark-users] Netmon 3 File Format
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 22 Jan 2007 11:25:32 -0800
Matt Reynolds wrote:


Currently it appears that .cap files created by Netmon 3 cannot be
opened by Wireshark (0.99.4).

What is the outlook for this going forward?
The outlook is that, as with *all* capture file formats, it will be handled only if
1) it's fully documented somewhere, and we have sample capture files on which to test our implementation 

or
2) we have sample capture files *and* detailed dissections of those files sufficient to reverse-engineer the format of those files (the more link-layer types for which we have samples, the better).
(and if somebody has time to do the work - there's significantly more work in case 2 than in case 1).