On Wed, Dec 04, 2002 at 01:01:54PM +0100, EXT / SITICOM KURZWEG wrote:
> Did the capture file import filters
They're not really "filters" - we read all file formats in the same fashion,
regardless of whether they're libpcap format (Ethereal's native format)
or not.
> changed between 0.9.4 and 0.9.7?
At least some of the capture file reading modules changed between 0.9.4
and 0.9.7.
> With
> version 0.9.7, Ethereal is complaining about an unsupported Ethernet type 10
> and refuses to open my capture files.
>
> I'm using an Fluke Networks probe (Optiview) to make captures on a network.
> Those captures are saved as .cap files...
At least two different capture file formats use ".cap" as the suffix
(Microsoft Network Monitor, and "NetXRay", which is what NetXRay used
and the Windows version of the Sniffer code uses), so "as .cap files"
doesn't specify the format. There may be other formats where ".cap" is
used as well.
We'd need to know which one of them the Optiview captures are saved as;
neither the NetXRay reader nor the Network Monitor reader appears to
have changed between 0.9.4 and 0.9.7 in such a fashion as to cause a
problem with an "unsupported Ethernet type 10". What was the *exact*
text of the message printed or displayed when it failed to open the
file? (If you're doing this on UNIX, and you run Ethereal from a
terminal window such as an xterm, it should print the message on the
terminal window; on Windows, it might pop up a console window in which
to display the message.) That message should say something such as
"XXX: network type 10 unknown or unsupported", with "XXX" being
something such as "netmon" or "ngsniffer" or "netxray".)