Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 7381] pcapng - mergecap generates unusable file if interfa

Date: Wed, 11 Jul 2012 10:11:05 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7381

--- Comment #10 from Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> 2012-07-11 10:11:04 PDT ---
(In reply to comment #8)
> So one alternative would be to merge all interfaces that have the same
> link-layer type and the same values for all options.  This could, in theory,
> result in interfaces that *shouldn't* be merged being merged anyway; adding an
> additional IDB option for the host name of the machine on which the capture is
> being done (if you're doing an rpcap or other remote capture, this would be the
> name of the machine running the capture program, *not* the remote machine with
> the interface - that machine's host name would be in the interface name, as
> that would be the URL used) would probably prevent most if not all of those.

The IDB:

https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionidb

also is allowed to contain the MAC and/or IPv4 and/or IPv6 addresses of the
interface.  The MAC, in particular, should be a pretty good way to uniquely
identify an interface.  (No, it wouldn't work for localhost and it's much less
unique for VMs, but...)

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.