Wireshark · Ethereal-users: [Ethereal-users] Can't editcap recognize nettl files?

[shashank karnad <shashank_karnad@xxxxxxxxxxx>]

Hi All,
       ethereal & editcap man pages claim to support
HP-UX nettl format. And later, while browsing thro'
the mailing list, I learnt that as of Jan 2001,
ethereal(and consequently, I presume editcap too) can
understand nettl files only if captured at IP and
LAPB(SX25L2) layers. Are those the only supported
protocols even as of today?
      I did capture traces at IP layer and got it
readable by ethereal, however, apparently editcap seem
to not recognize it. I get the following error:
------------------------------------------------------
# ./editcap -v -F snoop /tmp/ip.TRC0 /tmp/ip2snoop
File /tmp/ip.TRC0 is a HP-UX nettl trace capture file.
editcap: Can't open or create /tmp/ip2snoop: Files
from that network type can't be saved in that format
------------------------------------------------------
Can you tell me why is this happening? Is it because
the traces are not captured at link layer? If yes,
which link layer protocol does ethereal understand?
Does this also mean that 'editcap' is incapable of
supporting conversion of any nettl trace file meaning
capture at any layer to any other file format?
 


Thanks,
Shashank



________________________________________________________________________
Everything you always wanted to know about cars and bikes,now
 at: http://in.autos.yahoo.com