Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3096] Ability to annotate packet captures

Date: Thu, 16 Feb 2012 22:21:47 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3096

--- Comment #54 from Anders Broman <anders.broman@xxxxxxxxxxxx> 2012-02-16 22:21:45 PST ---
(In reply to comment #53)
> (In reply to comment #52)
> > Created attachment 7841 [details]
> > Make wireshak copy SHB
> 
> After revision #41032 should it be possible to have the SHB options copied when
> doing pcapng file manipulations with all wireshark tools (excluding dumpcap)?
> Or they need to be modified to start using wtap_dump_open_ng() ?
> 
> 
> As of rev 41040 tshark still creates an SHB without options:
> 
>  # wireshark-1.7.1-SVN-41040/dumpcap -i p132p1 -c 1 -w /tmp/rev41040.pcapng
>  # wireshark-1.7.1-SVN-41040/tshark -r /tmp/rev41040.pcapng -w /tmp/new.pcapng
> 
> Notes:
>  * rev41040.pcapng will be created with shb_os and shb_userappl options.
>  * the shb block of new.pcapng is created without options
>  * tshark appears to use wtap_dump_open() to create the new pcapng file
>    (should it start using wtap_dump_open_ng()?)
> 
> /jpo

Ultimatly probably yes, but let's try to make handling of SHB and IDB work for
Wireshark first the signature may have to change. ISB is another challenge as
well.
/Anders

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.