Wireshark · Ethereal-users: [Ethereal-users] Re: ethereal output format

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

the native format for ethereal is pcap


On 7/21/05, Elizabeth Van Nostrand <eevannos@xxxxxxxxxx> wrote:
> I'm writing a program to take capture files, filter out the packets 
> specific to a particular program, and display them for the user.  It's 
> designed for debugging.  This would be a lot easier if I knew the format 
> of ethereal capture files, but I haven't had any luck finding the 
> specifications.   Does anyone know where to find a detailed description of 
> the output format?  Any format would do, but I'd prefer libpcap if 
> possible.  Thanks,
>         -Elizabeth Van Nostrand
>