Ethereal-dev: [Ethereal-dev] RE: Question on Ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx>
Date: Tue, 7 Oct 2003 17:02:27 -0700 (PDT)
On Tue, 7 Oct 2003, Herman, Matthew wrote:

> We are using Sniffer Distributed Release 4.2.  I am also using Ethereal
> version 0.9.15 (c) and also reading the users manual guide htm.
> What I did was to create my own directory named c:\Matt's captures
> It has a drop down box that gives you a bunch of file formats that you can
> save captures to.  The choices that apply to me are 
> File type:
> Network Associates Sniffer (Dos-Based)
> Network Associates Sniffer (Windows based) 1.1
> Network Associated Sniffer (Windows-based) 2.00x
> I called network Associates and the tech said to try the first format that
> they developed that is .enc he said it is open and most people use it now.
> I tried it and it did not work as well as the other two choices.  I tried to
> force it by naming the file .cap or .enc and still choose from the drop down
> list.  In the Sniffer distributed when I try to open the file all I get is
> the error message that it does not support that format.
> Thanks so much for even replying to my first e-mail.  Very much appreciated.
> I have to be doing something small and basic wrong.  I really like Ethereal
> and would greatly appreciate any pointers as to what I am doing wrong.

OK, I am not sure, but I have copied Ethereal-Dev. We might get some 
answers from there about what version we should save the capture in to 
allow 4.2 to read it.

Alternatively, if you can send us a capture from your version of Sniffer, 
we might be able to add that format.

> Thanks again,
> Matt Herman
> -----Original Message-----
> From: Richard Sharpe [mailto:rsharpe@xxxxxxxxxxxxxxxxx] 
> Sent: Tuesday, October 07, 2003 11:09 AM
> To: Herman, Matthew
> Subject: Re: Question on Ethereal
> 
> 
> On Tue, 7 Oct 2003, Herman, Matthew wrote:
> 
> > I am trying to use Ethereal to capture packets and save them.  I would 
> > like to display them on our Network Associates Sniffer.  I am saving 
> > them as.cap but when I try to open them with the Sniffer the file type 
> > is not supported. Do you have any advice on what I am doing wrong?
> 
> You need to save them in the correct format ... File->Save As... and 
> click on the File Type button, which should show you a couple of Sniffer 
> Formats.
> 
> What feature in Sniffer do you need?
> 
> Regards
> -----
> Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
> sharpe[at]ethereal.com, http://www.richardsharpe.com
> 

-- 
Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com