Comment # 6
on bug 8229
from Guy Harris
(In reply to comment #5)
> Created attachment 9886 [details]
> Sample capture file with missing Ethernet header.
>
> This capture file contains a single ICMP "destination unreachable" packet,
> except there's no Ethernet header so Wireshark is unable to dissect it.
Running "editcap -T rawip -F libpcap {that capture file} {path for new capture
file}" also produces a capture file that works with Wireshark (and presumably
other libpcap-capable programs that understand DLT_RAW, e.g. tcpdump) can read.
("editcap -T rawip" does *NOT* work with the 1.8.x editcap; the resulting
pcap-ng file doesn't have the right link-layer header type for the interface.
There are a number of problems with the current way we handle per-file
link-layer header types and per-interface information; some rearchitecting of
both libwiretap and the programs that use it, including API changes, are needed
for this and other problems. But I digress....)
You are receiving this mail because:
- You are watching all bug changes.