Wireshark · Wireshark-dev: Re: [Wireshark-dev] nettl (HP-UX) - Added dump capability

[Guy Harris <guy@xxxxxxxxxxxx>]

The code you added (a couple of years ago) to support writing nettl 
files put "ethereal" in the host name field of the nettl header.

Unfortunately, that field is 9 bytes long, which presumably means 8 
characters plus a terminating '\0', and that's not big enough to hold 
the new name of the application - "wireshark" - if you include the 
terminating '\0'.

The current top-of-tree Subversion code currently writes out "wshark", 
but, given that we don't necessarily know the name of the host on which 
the capture we're writing out was done, would we be better off writing 
out an empty string?  Can HP's tools that read nettl captures handle an 
empty host name string?