https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3524
Summary: PCAP-NG output bug?
Product: Wireshark
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: Minor
Priority: Low
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: ddawson@xxxxxxxxxxxx
Build Information:
Version 1.0.7
Compiled with GTK+ 2.14.7, with GLib 2.20.0, with libpcap 1.0.0, with libz
1.2.3.3, with POSIX capabilities (Linux), with libpcre 7.8, without SMI, with
ADNS, with Lua 5.1, with GnuTLS 2.6.4, with Gcrypt 1.4.4, with MIT Kerberos,
with PortAudio V19-devel (built Oct 12 2008), without AirPcap.
Running on Linux 2.6.28.10-ddawson, with libpcap version 1.0.0.
Built using gcc 4.3.3.
--
Currently (as of 1.0.7) Wireshark produces PCAP-NG files that appear (to me) to
violate the spec. These files contain one Interface Description Block, and have
Enhanced Packet Blocks with interface ID=1. However, the spec reads, in part:
"Interface ID: Tools that write / read the capture file associate a progressive
16-bit number (starting from '0') to each Interface Definition [sic] Block"
(section 3.2). This is from
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
Apologies if this has been fixed already.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.