Guy Harris:
>At least two different capture file formats use ".cap" as the suffix
>(Microsoft Network Monitor, and "NetXRay", which is what NetXRay used
>and the Windows version of the Sniffer code uses), so "as .cap files"
>doesn't specify the format. There may be other formats where ".cap" is
>used as well.
>
>We'd need to know which one of them the Optiview captures are saved as;
>neither the NetXRay reader nor the Network Monitor reader appears to
>have changed between 0.9.4 and 0.9.7 in such a fashion as to cause a
>problem with an "unsupported Ethernet type 10". What was the *exact*
>text of the message printed or displayed when it failed to open the
>file? (If you're doing this on UNIX, and you run Ethereal from a
>terminal window such as an xterm, it should print the message on the
>terminal window; on Windows, it might pop up a console window in which
>to display the message.) That message should say something such as
>"XXX: network type 10 unknown or unsupported", with "XXX" being
>something such as "netmon" or "ngsniffer" or "netxray".)
There are some other ".CAP" file types. One site listed these:
Network Associates Sniffer Capture File
Agilent LAN Analyzer Capture File
Fluke Protocol Inspector Capture File
Microsoft NetMon Capture File
Shomiti Surveyor Capture File
Sun Snoop Capture File
TTC FireBerd 500 PC Capture File
WWG Domino Capture File
WWG LinkView PRO Capture File
Fluke Optiview cap-format (same as Finisar Surveyor ????) might be based on the snoop
format:
http://www.ethereal.com/lists/ethereal-users/200208/msg00149.html
http://techupdate.zdnet.com/eweek/stories/pipreviews/0,11535,436131,00.html
http://www.thetechfirm.com/fluke_ope/
However it seems that maybe it is possible to convert to NAI Sniffer enc-format (and
Internet Advisor format)
directly from the Optiview.
The enc-format files might work better with Ethereal.
Regards,
Martin
