Wireshark · Wireshark-users: Re: [Wireshark-users] 答复: how can i open the package of iris saved

[Guy Harris <guy@xxxxxxxxxxxx>]

dxf206_163 wrote:
> thanks for your help. 
>
> but while i use capinfos, it tell me "capinfos: Can't open e:\untitled.cap:
> The file isn't a capture file in a known format", i think ,before wireshark
> open a file, it use capinfos to get infomation from file,

No, it doesn't - but Wireshark and capinfos use the same code to read 
files, so, if Wireshark can't read a file, capinfos can't, either.

As I said in my other mail, we would need to add code that can read Iris 
files to the library used by Wireshark and capinfos (and TShark and 
editcap) to read capture files.  In order to do that, we'd need the 
information the FAQ entry mentions, i.e. (quoting the FAQ)

	we would either have to have a specification for the file format, or 
the extensions, sufficient to give us enough information to read the 
parts of the file relevant to Wireshark, or would need at least one 
capture file in that format AND a detailed textual analysis of the 
packets in that capture file (showing packet time stamps, packet 
lengths, and the top-level packet header) in order to reverse-engineer 
the file format.

and note also that (again, quoting the FAQ)

	there is no guarantee that we will be able to reverse-engineer a 
capture file format.