https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3961
--- Comment #5 from Guy Harris <guy@xxxxxxxxxxxx> 2010-11-24 10:48:48 PST ---
*Wireshark* - and TShark - are capable of handling WTAP_ENCAP_PER_PACKET, so
they can handle a pcap-ng file with multiple interfaces with different
link-layer types. In fact, there are some file formats that used
WTAP_ENCAP_PER_PACKET before pcap-ng did.
The best we could do would be to:
1) "support" WTAP_ENCAP_PER_PACKET for all file types;
2) for file types that don't support multiple link-layer types, fail as
soon as you try to write a packet with a link-layer type that isn't the same as
all the ones that have been written previously.
Perhaps Wireshark could keep track of all the link-layer types it sees, and we
could have APIs to ask whether a file type supports multiple link-layer types,
and Wireshark could avoid even trying to save a capture with multiple
link-layer types in a format that doesn't support it, but the "one-pass"
programs can't do that.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
