Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3096] Ability to annotate packet captures

Date: Thu, 16 Feb 2012 12:38:21 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3096

--- Comment #53 from Jose Pedro Oliveira <jpo@xxxxxxxxxxxx> 2012-02-16 12:38:17 PST ---
(In reply to comment #52)
> Created attachment 7841 [details]
> Make wireshak copy SHB

After revision #41032 should it be possible to have the SHB options copied when
doing pcapng file manipulations with all wireshark tools (excluding dumpcap)?
Or they need to be modified to start using wtap_dump_open_ng() ?


As of rev 41040 tshark still creates an SHB without options:

 # wireshark-1.7.1-SVN-41040/dumpcap -i p132p1 -c 1 -w /tmp/rev41040.pcapng
 # wireshark-1.7.1-SVN-41040/tshark -r /tmp/rev41040.pcapng -w /tmp/new.pcapng

Notes:
 * rev41040.pcapng will be created with shb_os and shb_userappl options.
 * the shb block of new.pcapng is created without options
 * tshark appears to use wtap_dump_open() to create the new pcapng file
   (should it start using wtap_dump_open_ng()?)

/jpo

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.