Wireshark · Ethereal-dev: [ethereal-dev] Null capture type ...

[Richard Sharpe <sharpe@xxxxxxxxxx>]

Hi,

Hmmm, a little experimentation, producing a Null capture with my little
program shows me that Ethereal already understands a capture file that
starts with

   0xFF000800 

as long as it is set as a NULL ENCAP type in the Wiretap file ...

Hmmm, I wonder if I only need a flag to force Ethereal to treat the
contents of a file as NULL ..., like -N ...

Regards
-------
Richard Sharpe, sharpe@xxxxxxxxxx, Master Linux Administrator :-),
Samba (Team member, www.samba.org), Ethereal (Team member, www.zing.org)
Co-author, SAMS Teach Yourself Samba in 24 Hours
Author: First Australian 5-day, intensive, hands-on Linux SysAdmin course