Wireshark-users: Re: [Wireshark-users] where is WTAP_ENCAP type 80 (K12) in Import menue/or why i
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ariel Burbaickij <ariel.burbaickij@xxxxxxxxx>
Date: Tue, 5 Mar 2013 07:24:05 +0100
>If the file you have in front of you is "with WTAP_ENCAP 42", then it's either:

>1) a pcap file with a link-layer encapsulation type of 140 (LINKTYPE_MTP2/DLT_MTP2)

>or

>2) a pcap-ng file all the interfaces of which have a link-layer encapsulation type of 140 (LINKTYPE_MTP2/DLT_MTP2).

>It's definitely not an rf5 file, as they all are given a WTAP_ENCAP_ value of WTAP_ENCAP_K12 by Wireshark.
I have several captures. One of them is definitely in rf5 format, another one is definitely in pcap format. What I meant is  that from looking  at supported DLT_TYPEs and then WTAP_ENCAP (sets of supported encapsulations are different) it appeared to me that development of wireshark and tcereplay happens totally independent from each other -- previously I thought/hoped that it happens in more coordinated way.
That is why I asked then:
 Does it mean that the development of wireshark/wiretap
 and tcpreplay happens in totally independent way?
in order to be sure that this is indeed what (somewhat sadly) happens.

So, looks like I will have to delve deeper in this DLT plugin stuff.
 
/wbr
Ariel Burbaickij