Ethereal-dev: Re: [Ethereal-dev] source code for observer file format

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 30 Oct 2003 16:50:27 -0800

On Oct 30, 2003, at 10:29 AM, Scott Emberley wrote:

Could you add the following files to the source tree.

Checked in, with fixes to handle the byte-order and C++-comment issues, and the relevant changes to file_access.c, wtap.h, Makefile.am, and Makefile.nmake; I left the guint64 stuff in, as some dissectors (e.g., RSVP) are using it unconditionally. If nobody complains about 0.9.16, we should perhaps treat that as an indication that we can, by and large, safely use guint64 (although we can *NOT* use %ll{d,o,u.x} to print 64-bit integers - *printf on most UNIXes supports it, but that's not the case with all UNIXes, and *printf on Windows uses something else).

I have been give the OK to add writing to this format once this source has been posted.

What about support for other link-layer types (802.11, FDDI, WAN) and earlier versions of Observer? (The fact that Ethernet has a link-layer type of 0 and Token Ring has a link-layer type of 1 suggests that the link-layer type is an NDIS network type value - 1, in which case FDDI would be 2.)