Wireshark · Wireshark-dev: Re: [Wireshark-dev] develop a tool to parse captured file

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 2, 2007, at 8:12 PM, Stephen Fisher wrote:

> Wireshark's main file format is normal libpcap:
>
>  http://wiki.wireshark.org/Development_2fLibpcapFileFormat

...which means you can use libpcap on UN*X and WinPcap on Windows to  
read the packets.

Note that what you get from libpcap/WinPcap is raw packet data;  
parsing the link-layer header, IP header (if the packet is IP), etc.  
is up to the developer of the program using libpcap/WinPcap.