Wireshark · Ethereal-users: Re: [Ethereal-users] airsnort wants a pcap file.. how to output that?

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, May 21, 2004 at 01:52:10AM +0200, Peter Marquardt wrote:
> I am using Ethereal in Win XP SP2 to capture packets which I then feed 
> AirSnort compiled in Windows. AirSnort wants a "pcap File" and I thought 
> that was what Ethereal wrote by default, but since it's importing an 
> ungodly huge number of packets without ever stopping I am wondering if 
> my compile of AirSnort went wrong or if rather the tcpdump format of 
> Ethereal is not what AirSnort calls "pcap".

"libpcap format" and "tcpdump format" are the same thing - "libpcap
format" is the format written by libpcap and by Ethernet's capture file
code, and tcpdump uses libpcap to write its capture files.

"pcap" probably just refers to libpcap.

It's probably either

	1) a problem with AirSnort

or

	2) AirSnort not stopping when it gets to the end of captures
	   because it's not intended to do so.