Wireshark-dev: Re: [Wireshark-dev] capturing from a named pipe - other file formats

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 21 Jun 2010 13:37:31 -0400
Rolf Fiedler wrote:
At the moment wireshark only supports the libpcap trace file format when capturing from a named pipe or stdin. I would like to extend this to support the EyeSDN trace file format for captures from ISDN interfaces. Would this cause any problems? What would be a good place to start? The EyeSDN trace file format has a magic at the start so the file format could be detected. Or would we need an additional command line parameter to specify the format?

You'd probably need another command line argument. Figuring out the file encapsulation requires (I believe) the ability to seek within the file--something that doesn't work with pipes. To avoid that you'd have to tell the software what the encapsulation is.