Comment # 2
on bug 12167
from Ondrej Holecek
(In reply to Guy Harris from comment #1)
> Did you try it with a file constructed by concatenating a big-endian pcapng
> file and a little-endian pcapng file? Nothing in the pcapng spec requires
> that all sections have the same byte order.
I can try it tomorrow if you mean it seriously, however I don't understand why
this particular thing shouldn't work - if this bug is fixed correctly, the code
learns the endianness from the beginning of each SHB. Provided that the
subsequent interfaces, enhanced packet and other blocks share the same
endinanness. (Which I believe is reasonable assumption.)
> Make sure it works with Wireshark, too - and doesn't get confused by the
> resetting of the interface list in the second section.
I have a capture [happy? :)] containing 20000 packets where each SHB has 100
packets max and it seems to work well in tshark and wireshark - all packets are
displayed, filtered packets from different sections are shown, etc. But I do
agree that this is not a proper test. I cannot provide the files I use
(customer's data) but I can generate some publishable if it would be helpful).
You are receiving this mail because:
- You are watching all bug changes.
