In the previous version of Wireshark, the conversion from ERF to libpcap
was like this:
For TYPE_ATM, TYPE_AAL5
WTAP_ENCAP_ATM_PDUS;
or WTAP_ENCAP_ATM_RFC1483;
or WTAP_ENCAP_ATM_PDUS_UNTRUNCATED;
For TYPE_ETH:
WTAP_ENCAP_ETHERNET;
For TYPE_HDLC_POS:
WTAP_ENC
On Mar 11, 2008, at 1:15 PM, Stephen Donnelly wrote:
> When you save a capture in libpcap format Wireshark doesn't prompt you
> for which DLT to use?
No. That's supposed to happen automatically.
> How does it decide which DLT is appropriate?
It decides based on the encapsulation type of the i
On Tue, 2008-03-11 at 01:04 -0700, Guy Harris wrote:
> vcarela wrote:
>
> > The problem is that if I capture with wireshark a trace from my eth0
> > connection and I save it as a "Wireshark/tcpdump/...-libpcap" file. Then
> > when I run the sniffer with this pcap trace the sniffer runs properly.
