Wireshark-dev: Re: [Wireshark-dev] develop a tool to parse captured file

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 2 Jul 2007 21:01:53 -0700

On Jul 2, 2007, at 8:12 PM, Stephen Fisher wrote:

Wireshark's main file format is normal libpcap:

 http://wiki.wireshark.org/Development_2fLibpcapFileFormat

...which means you can use libpcap on UN*X and WinPcap on Windows to read the packets.

Note that what you get from libpcap/WinPcap is raw packet data; parsing the link-layer header, IP header (if the packet is IP), etc. is up to the developer of the program using libpcap/WinPcap.