Wireshark · Ethereal-users: Re: [Ethereal-users] netmon capture format npl

[Guy Harris <gharris@xxxxxxxxx>]

wmeng wrote:

>    i write a netmon 1.x and 2.x capture format in npl.

What's "npl"?

> Although it can
> work using in jnetstream but still have some bugs in it. Like in the
> very end of the capture file that save using ethereal in netmon(1.x of
> 2.x) format have some unknown data (4 byte for each frame) that didn't
> relate and jnetstream decode it as a invalid data. Anyone know what
> that "unknown" data

See the Ethereal code for reading and writing Network Monitor files 
(wiretap/netmon.c) - it's the "frame table", which contains, for each 
packet in the file, the offset in the file of the packet's record.