Wireshark · Ethereal-users: Re: [Ethereal-users] New User - How do I cpature/save Cisco Debugs For Analysis

[Guy Harris <guy@xxxxxxxxxx>]

On Fri, Jun 21, 2002 at 12:09:25AM +0200, M.C. van den Bovenkamp wrote:
> If either of the interfaces is not Ethernet, that's not the case, anf 
> Funky Stuff happens when the output of the script gets fed to text2pcap 
> :-). But perhaps something could be reverse-enineered about the 
> resulting hexdump (fake addresses and using only select bits of it?). I 
> haven't looked at it that deeply (yet?).

Well, if the interface was a Token Ring interface, for example, perhaps
Correct Stuff would happen if you ran text2pcap with "-l 6" to tell
text2pcap to mark the output file as a Token Ring capture rather than an
Ethernet capture.

There may be other interface types for which that can be made to work
(e.g., FDDI, with "-l 10"); WAN interfaces might be trickier, as I don't
know whether the header would be a PPP header or would include
WAN-type-specific headers.