Wireshark · Ethereal-dev: [ethereal-dev] Help needed to add new file format decoding capabi lities to Ethereal

["Yann Samama" <ysamama@xxxxxxxxxxxxxxxxxx>]

Title: [ethereal-dev] Help needed to add new file format decoding capabilities to Ethereal

Hi List,

I want to add to Ethereal the ability to read new type of files that are generated by some commercial sniffers.
As I read through the different files in the wiretap sub-directory, it raised several issues :

1/ Is it possible to have a "read" function that can work on non-contiguous blocks of data?

2/ Is it possible to have the data-link layer type to be defined on a per packet basis, rather than by a per file basis?

3/ What are the differences between the "read" and the "seek and read" functions?

I would really appreciate if you could help me on those matters.

Thanks in advance,

Yann.