Wireshark · Ethereal-users: [Ethereal-users] netmon capturer format (2)

["wmeng" <wmeng@xxxxxxxxxxxxx>]

Sorry about the previous mail, let me write clearly i writing a netmon
capture format in npl(network protocol language)and try to open file that
saving in netmon format using Jnetstream (netmon capture format didn't
declare in Jnetnetstream).

Although it can work in jnetstream but still have some bugs in it. Like in
the very end of the capture file (that i open using ultraEdit) that save
using ethereal in netmon(1.x of 2.x) format have some unknown data (4 byte
for each frame/packet) that didn't relate and jnetstream decode it as a
invalid data. Anyone know what that "unknown" data is?

I write the netmon capture format base on the netmon.c and if i'm not
mistake it didn't mention about the "unknown" data.

It's a bug that saving in netmon format using ethereal?
Anyone know?


                                                                  regards
                                                                  wmeng