["Guy Harris" <gharris@xxxxxxxxx>]

Larry Adams said:
> I think Ethereal needs an updated Network Associates file format decoder
> to cover the changes in their format.

We'd update the decoder if we knew what the changes were.

Unfortunately, we don't; the code to read the Windows Sniffer files was
not written based on a published specification of the file format, it was
written based on reverse-engineering the file format by looking at files
in that format and at how they're interpreted by Sniffer.  Merely knowing
that something changed isn't sufficient to allow us to change our code to
deal with that change; we have to know what the change is.

The time stamps in Windows Sniffer captures are not always interpreted
correctly by Ethereal; unfortunately, we have not yet been able to
reverse-engineer the file sufficiently to figure out what data in the file
specifies how to compute the time stamps correctly.