Guy Harris skrev 2013-05-12 00:52:
On May 2, 2013, at 9:25 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:
Alternatively if the file is rewritten on the first pass writing the reassembled data together with the packet holding the last fragment the reassembled data could be read together with the packet
But that might have other problems and might require changes to the file format description (pcap-ng)
Not all capture files are pcap-ng files.
Not all the capture files that aren't pcap-ng files are pcap files.
Not all the capture files that are neither pcap-ng files nor pcap files have link-layer header types supported by pcap or pcap-ng.
Anything that assumes that capture files are all pcap or pcap-ng won't work.
So either this is a bad idea, don't pursue it or everything we can read
we should be able to write in pcap-ng
as a temporary file at least. Depending on what's most important file
support could be dropped until
it could be represented in pcap-ng.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe