[Nathan Neulinger <nneul@xxxxxxx>]

> + * New Data-link level type for win32.
> + */
> +#ifdef WIN32
> +#define DLT_EN100MB    100     /* Ethernet (100Mb) */
> +#define DLT_PPP_WIN32  101     /* Win32 dial up connection */
> +#endif

>  {
> +#ifdef WIN32
> +   /* 2 NEW Encaps for win32 100 - 100Mb Eth and 101 - PPP wan */
> +   if (encap == DLT_EN100MB)
> +      return WTAP_ENCAP_ETHERNET;
> +   if (encap == DLT_PPP_WIN32)
> +      return WTAP_ENCAP_PPP;
> +#endif
> 
> Do you have a "DLT_PPP_WIN32" trace available? We discovered that the
> NDIS type for "WAN" indicates a packet with a fake ethernet header on it.
> It is possible, if libpcap for win32 uses the same NDIS facility as
> NetXRay, that "DLT_PPP_WIN32" should really return WTAP_ENCAP_ETHERNET.

In either case, do we really want to have those ifdef'd out? Wouldn't it
be better to have them in always, that way those captures can be read on
non-win32 hosts?

-- Nathan

------------------------------------------------------------
Nathan Neulinger                       EMail:  nneul@xxxxxxx
University of Missouri - Rolla         Phone: (573) 341-4841
CIS - Systems Programming                Fax: (573) 341-4216