https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6846
--- Comment #3 from Jose Pedro Oliveira <jpo@xxxxxxxxxxxx> 2012-02-15 21:03:24 PST ---
(In reply to comment #2)
> There are two possibilities here:
>
> 1) the new dumpcap is not writing valid pcap-NG files;
I managed to pinpoint the commit where the problem started: commit 41026.
>
> 2) the pcap-NG reading code in the older versions of Wireshark can't read
> all valid pcap-NG files.
>
> Given that a file I just wrote with top-of-trunk dumpcap can be read by a
> tcpdump linked with top-of-trunk libpcap, my guess is that 2) is the correct
> answer. Perhaps their open routines don't handle SHBs with options. I'll look
> at that and, if that's the case, schedule fixes for 1.4.x and 1.6.x (people
> stuck using older versions of Wireshark will have to do the fix themselves -
> the pcap-NG spec allows options, so we shouldn't just avoid them forever just
> because older versions of Wireshark have bugs and some organizations have
> annoying IT policies).
Tomorrow I'll give another try to figure out why the new pcapng can no longer
be opened. Regarding SHB with options: dumpcap, prior to rev41026, already
created SHB with one option - shb_userappl.
/jpo
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
