[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3961

           Summary: Can't convert from .pcapng to .pcap with versions 1.2.1
                    and 1.3.0
           Product: Wireshark
           Version: 1.2.1
          Platform: Other
        OS/Version: Windows XP
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Extras
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: j.snelders@xxxxxxxxxx


Build Information:
Version 1.2.1 (SVN Rev 29141)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.2, with GLib 2.20.3, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
with c-ares 1.6.0, with Lua 5.1, with GnuTLS 2.8.1, with Gcrypt 1.4.4, with MIT
Kerberos, with GeoIP, with PortAudio V19-devel (built Jul 19 2009), with
AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1
beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS 2.8.1,
Gcrypt 1.4.4, with AirPcap 4.0.0 build 1480.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
No problems to convert .pcap to .snoop:
$ editcap -F snoop test_121.pcap test_121pcap.snoop

Errors when converting .pcapng to .pcap
$ editcap test2_121.pcapng test2_121pcapng.pcap

** (editcap.exe:2876): WARNING **: pcapng_open: opening file

** (editcap.exe:2876): WARNING **: pcapng_read_block: block_type 0xa0d0d0a

** (editcap.exe:2876): WARNING **: pcapng_read_section_header_block: SHB
(little endian) V1.0, len 28

** (editcap.exe:2876): WARNING **: pcapng_read: wth->data_offset is initially
28

** (editcap.exe:2876): WARNING **: pcapng_read: *data_offset is initially set
to  28

** (editcap.exe:2876): WARNING **: pcapng_read_block: block_type 0x1

** (editcap.exe:2876): WARNING **: pcapng_read_if_descr_block: IDB link_type 1
(Ethernet), snap 65535

** (editcap.exe:2876): WARNING **: pcapng_read: block type 0x1 not PB/EPB

** (editcap.exe:2876): WARNING **: pcapng_read: *data_offset is updated to 48

** (editcap.exe:2876): WARNING **: pcapng_read_block: block_type 0x6

** (editcap.exe:2876): WARNING **: pcapng_read_packet_block: packet data:
packet_len 62 captured_len 62 interface_id 0

** (editcap.exe:2876): WARNING **: pcapng_read_packet_block: encapsulation = 1
(Ethernet), pseudo header size = 0.

** (editcap.exe:2876): WARNING **: pcapng_read: wth->data_offset is finally 144
editcap: Can't open or create test2_121pcapng.pcap: Files from that network
type
 can't be saved in that format

$


+++++++
Version 1.3.0-SVN-29618 (SVN Rev 29618 from /trunk)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.5, with GLib 2.20.4, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
with c-ares 1.6.0, with Lua 5.1, without Python, with GnuTLS 2.8.1, with Gcrypt
1.4.4, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built Aug 29
2009), with AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1
beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS 2.8.1,
Gcrypt 1.4.4, with AirPcap 4.0.0 build 1480.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
===

No problems to convert .pcap to .snoop or .pcapng:
$ editcap -F snoop test_130.pcap test_130pcap.snoop
$ editcap -F pcapng test_130.pcap test_130pcap.pcapng

Error when converting .pcapng to .pcap:
$ editcap test_130.pcapng test_130pcapng.pcap
editcap: Can't open or create test_130pcapng.pcap: Files from that network type
can't be saved in that format


+++++++
Back to:)
Version 1.1.3 (SVN Rev 27807)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.0, with GLib 2.20.0, with WinPcap (version unknown),
with libz 1.2.3, without POSIX capabilities, with libpcre 7.0, with SMI 0.4.8,
with c-ares 1.6.0, with Lua 5.1, with GnuTLS 2.6.4, with Gcrypt 1.4.4, with MIT
Kerberos, with GeoIP, with PortAudio V19-devel (built Mar 21 2009), with
AirPcap.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1
beta5
(packet.dll version 4.1.0.1452), based on libpcap version 1.0.0, GnuTLS 2.6.4,
Gcrypt 1.4.4, with AirPcap 4.0.0 build 1480.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
===

No problems to convert the files:
$ editcap test_113.pcapng test_113pcapng.pcap
$ editcap test_121.pcapng test_121pcapng.pcap
$ editcap test2_121.pcapng test2_121pcapng.pcap
$ editcap test_130.pcapng test_130pcapng.pcap
+++++++


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.