I found that vms.c and dbs-etherwatch claimed that the file was encoded on a per packet basis, but was really encoded as RAW_IP. This prevented saving anything other than the whole file in the original format. Now, individual packets may be saved in libpcap format.
Index: wiretap/dbs-etherwatch.c
===================================================================
RCS file: /cvsroot/ethereal/wiretap/dbs-etherwatch.c,v
retrieving revision 1.1
diff -u -r1.1 wiretap/dbs-etherwatch.c
--- wiretap/dbs-etherwatch.c 2001/10/19 20:18:48 1.1
+++ wiretap/dbs-etherwatch.c 2002/01/08 22:04:10
@@ -153,7 +153,7 @@
}
wth->data_offset = 0;
- wth->file_encap = WTAP_ENCAP_PER_PACKET;
+ wth->file_encap = WTAP_ENCAP_RAW_IP;
wth->file_type = WTAP_FILE_DBS_ETHERWATCH;
wth->snapshot_length = 16384; /* just guessing */
wth->subtype_read = dbs_etherwatch_read;
Index: wiretap/vms.c
===================================================================
RCS file: /cvsroot/ethereal/wiretap/vms.c,v
retrieving revision 1.2
diff -u -r1.2 wiretap/vms.c
--- wiretap/vms.c 2001/12/24 17:00:01 1.2
+++ wiretap/vms.c 2002/01/08 22:04:10
@@ -159,7 +159,7 @@
}
wth->data_offset = 0;
- wth->file_encap = WTAP_ENCAP_PER_PACKET;
+ wth->file_encap = WTAP_ENCAP_RAW_IP;
wth->file_type = WTAP_FILE_VMS;
wth->snapshot_length = 16384; /* just guessing */
wth->subtype_read = vms_read;
This message has been 'sanitized'. This means that potentially
dangerous content has been rewritten or removed. The following
log describes which actions were taken.
Sanitizer (start="1010528167"):
Part (pos="970"):
Part (pos="98"):
SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
Match (rule="2"):
Enforced policy: accept
Part (pos="453"):
SanitizeFile (filename="unnamed.html", mimetype="text/html"):
Match (rule="default"):
Enforced policy: accept
Rewrote HTML tag: >>_META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"_<<
as: >>_MANGLED_ON_PURPOSE_META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"_<<
Rewrote HTML tag: >>_META NAME="GENERATOR" CONTENT="GtkHTML/1.0.1"_<<
as: >>_MANGLED_ON_PURPOSE_META NAME="GENERATOR" CONTENT="GtkHTML/1.0.1"_<<
Part (pos="2036"):
SanitizeFile (filename="vms.patch", mimetype="text/plain"):
Match (rule="2"):
Enforced policy: accept
Total modifications so far: 2
Anomy 0.0.0 : Sanitizer.pm
$Id: Sanitizer.pm,v 1.32 2001/10/11 19:27:15 bre Exp $