Wireshark-bugs: [Wireshark-bugs] [Bug 2868] EditCap and TShark cannot convert some file formats to libpcap while Wireshark can

From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 4 Jan 2009 05:58:43 -0800 (PST)

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868





--- Comment #3 from Sake <sake@xxxxxxxxxx>  2009-01-04 05:58:42 PDT ---
This is caused by the fact that some capture formats can contain packets with
multiple encapsulation types in one file. Wireshark reads all packets and if
they are of the same type, it is able to save all the packets to a libpcap file
(which can contain only one encapsulation type for all packets). Editcap and
tshark do reading and writing in one run and therefor can not predict if all
packets are of the same encapsulation type. Therefore they say you can't save
to libpcap.

This however can be changed into something like: "Save all the packets with the
encapsulation type of the first packet and mention how many packets were not
saved". Or some other creative solution...


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.