Guy Harris
changed
bug 12504
| What |
Removed |
Added |
| Status |
UNCONFIRMED
|
INCOMPLETE
|
| Summary |
Saved pcapng file cannot be read by libpcap
|
Loopback capture has both Ethernet and loopback interfaces
|
| Ever confirmed |
|
1
|
Comment # 1
on bug 12504
from Guy Harris
Yes, the current APIs in libpcap *require* that all interface description
blocks in a pcapng file have the same link-layer header type; allowing libpcap
to read files with multiple link-layer header types would require a completely
new set of APIs for reading capture files.
OS X's libpcap has (undocumented) APIs of this sort (the code for which can't
be used in standard libpcap, as it's licensed under the APSL, which has patent
clauses that could cause some systems that ship libpcap to reject a version
with that code), so the tcpdump in newer versions of OS X *can* read that file.
However, programs written to use the standard APIs can't read them.
So the problem is that the capture has more than one IDB in it. How was that
capture done? What program was used to capture the traffic? What interface or
interfaces were used? If, for example, you captured it with the tcpdump that
comes with newer versions of OS X, and specified the "any" device, it may well
have IDBs for both the en0 device and the lo0 device, and therefore be
inherently unreadable by standard libpcap.
You are receiving this mail because:
- You are watching all bug changes.