Wireshark · Ethereal-dev: Re: [ethereal-dev] Null capture type ...

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Fri, Dec 03, 1999 at 02:52:07AM +1000, Richard Sharpe wrote:
> Hi,
> 
> Hmmm, a little experimentation, producing a Null capture with my little
> program shows me that Ethereal already understands a capture file that
> starts with
> 
>    0xFF000800 
> 
> as long as it is set as a NULL ENCAP type in the Wiretap file ...
> 
> Hmmm, I wonder if I only need a flag to force Ethereal to treat the
> contents of a file as NULL ..., like -N ...

What type of trace file is it? Libpcap, netmon, ... ?

--gilbert