Ethereal-users: Re: [Ethereal-users] SaveAs in LANalyzer-Format

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 22 May 2002 23:37:20 -0700
On Wed, May 22, 2002 at 12:11:09PM +0200, Gregor Glomm wrote:
> Here are the steps to get the "Save As Novell LANalyzer" bug.
> 
> 1) load an xxx.tr1 File
> 2) Save as Novell LANalyzer (see etherealbug.jpg)
> 3) Enter filename and press ok (see savebug.jpg)
> 
> The savebug.jpg message now was different to the first error-msg.

That's a bug, but it's unrelated to the LANalyzer issue - I can get it
when saving a capture file in libpcap format.  ("strncmp()" was being
used to compare the name of the input and output files, to make sure
they're not the same, and the third argument to "strncmp()" was a
"sizeof" whose operand was a "char *", so it compared the first 4
or 8 bytes of the file names, and, if *they* matched, erroneously
reported the files as being the same.)

I've checked in a fix.

> >On no system does the option to save in LANalyzer format exist; there is
> >
> Can't someone from netware programming this nice feature ?

Presumably you meant "someone from Novell" (Novell is the maker of
LANalyzer; NetWare is a product of Novell).

Somebody from Novell could probably write code to do that; however, I
haven't heard anybody from Novell volunteer to do so.

The file format is documented at

	http://secinf.net/info/nw/lan/trace.txt

However, writing code to write capture file formats is usually harder
that writing code to read them - when reading a capture file, you can
ignore fields that aren't necessary for the code that's reading them,
but when writing a capture file, you may have to write fields that the
code to read the capture file ignores.

You'd also probably have to have a copy of the program that uses that
file format, so you can test to make sure your code produces files that
program can read.  (I don't have a copy - and also don't have the time
to write the code for somebody else to test.)