[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Nov 13, 2002 at 02:59:54PM -0500, Joshua Wright wrote:
> If I haven't mentioned it already, I love Ethereal.  So powerful, yet
> so simple.  It's a wonder companies like Network Associates make money
> on Sniffer.

The Sniffer software current probably dissects more protocols, and has
more "expert" capabilities (the Ethereal TCP code has some of that now,
and it may be that the tap stuff will eventually allow a lot of
third-party experts to be written - especially if we can arrange that
it's possible to write tap code in scripting languages, not just
compiled languages).

Of course, there are other commercial sniffers, some of which might be
cheaper (NAI's Web site for Sniffers doesn't seem to show any prices or
let you buy Sniffers online - it appears you *have* to go through a
sales rep - so I can't do a price comparison).

> I discovered yesterday that the tethereal -c option only works when
> capturing live data.  Is it possible to add this feature to use when
> reading a libpcap file?

It would be easier to add the feature when reading any capture file, as
otherwise tethereal would explicitly have to check what type of file was
being read. :-)

It might be possible to do.  I don't know when somebody'll make it
happen, though.