https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6937
Summary: pcapng: shd_userappl in newly created files
Product: Wireshark
Version: 1.7.x (Experimental)
Platform: x86
OS/Version: Mac OS X 10.6
Status: NEW
Severity: Major
Priority: Low
Component: TShark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: jpo@xxxxxxxxxxxx
Build Information:
TShark 1.7.1 (SVN Rev 41483 from /trunk)
--
Pcap-ng files created by Wiretap API based tools (tshark, editcap, and
wireshark(?) at the moment) inherit the shb_userappl value from the source file
and they shouldn't.
Notes:
* Most likely the source file has been created by dumpcap
* Dumpcap pcapio API writes nul-terminated strings values to the pcapng file;
the wiretap API doesn't; the files will differ (option length values,
padding)
even if the new one is a copy of first one.
Example:
1) dumpcap ... -w first.pcapng
2) tshark ... -r first.pcapng -w new.pcapng
or
editcap ... first.pcapng new.pcapng
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
