Wireshark · Ethereal-users: Re: [Ethereal-users] libPCAP file Format

[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:
> If you need to capture use Net::Pcap.

Even if he *doesn't* need to capture he should consider using Net::Pcap, 
because...

> the file has a header like

...that might not remain true forever:

	http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

and (at least for pcap-NG files with only one link-layer type), libpcap 
will be updated to support reading those files with the existing APIs. 
(New APIs will be needed to fully support pcap-NG; those APIs will also 
support existing libpcap format.)

Also, using Net::Pcap might be easier than writing your own code to read 
libpcap files.