Ethereal-users: Re: [Ethereal-users] netmon capturer format (2)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 24 Jul 2005 19:16:35 -0700
wmeng wrote:

Sorry about the previous mail, let me write clearly i writing a netmon
capture format in npl(network protocol language)and try to open file that
saving in netmon format using Jnetstream (netmon capture format didn't
declare in Jnetnetstream).

Although it can work in jnetstream but still have some bugs in it. Like in
the very end of the capture file (that i open using ultraEdit) that save
using ethereal in netmon(1.x of 2.x) format have some unknown data (4 byte
for each frame/packet) that didn't relate and jnetstream decode it as a
invalid data. Anyone know what that "unknown" data is?

I write the netmon capture format base on the netmon.c and if i'm not
mistake it didn't mention about the "unknown" data.
You're mistaken. Look for "frame table" in that code. The "unknown" data is actually the "frame table", which stores the offsets in the file of each frame. 


It's a bug that saving in netmon format using ethereal?
No - if a Network Monitor file with a frame table in it can't be read by your NPL description in Jnetstream, it's a bug in your NPL description, not in Ethereal (or Network Monitor).