[Guy Harris <gharris@xxxxxxxxx>]

Jeff Morriss wrote:

> See:
>
> http://wiki.ethereal.com/Development_2fLibpcapFileFormat

And also note that it's called "libpcap" format because it's the format 
that libpcap uses, i.e. you almost always don't have to write your own 
code to read and write it.

Furthermore, note that, at some point, we will be using pcap-NG format:

	http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

and:

	if a program uses libpcap, rebuilding it with a new version of libpcap 
(or installing a new libpcap shared library, if your program is built 
with a shared libpcap) will enable it to read pcap-NG files (if they 
don't use features of pcap-NG, such as the ability to have packets of 
different link-layer types in the same capture, that can't be handled by 
the current API);

	if a program has its own code to read libpcap files, it won't be able 
to read pcap-NG files without being changed to do so.