Wireshark · Ethereal-users: [Ethereal-users] netmon capture foramt (3)

["wmeng" <wmeng@xxxxxxxxxxxxx>]

Jnetstream can read the capture file but at the very end of it contain the
"unknown" data(frame table) that can't deocde by jnetstream and it output
as having invalid data in the stream. Below is my capture file that open
in ultraedit

.. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. ..
10 00 09 3A 80 00 01 51 80 80 00 00 00
                        /\
As i know frametableoffset in netmon.c represent how many data (total data
in byte) in the capture file. Mean while frametablelength represent how
many data or "frame table" (in byte)in a capture file and it increase
4byte for each packet in that file. Jnetstream suppose decode until /\ and
the 80 00 00 00 is the "frame table or frametablelength". unfortunely
jnetstream decode 80 00 00 00 as invalid data.

                                                                    thanks