Wireshark-dev: Re: [Wireshark-dev] [ntar-workers] ExtendingWireshark libpcap format support, or
From: "Gianluca Varenni" <[email protected]>
Date: Mon, 1 Oct 2007 22:56:28 -0700
----- Original Message ----- 
From: "Gianluca Varenni" <[email protected]>
To: "Developer support list for Wireshark" <[email protected]>
Sent: Thursday, September 27, 2007 4:52 PM
Subject: Re: [Wireshark-dev] [ntar-workers] ExtendingWireshark libpcap format support, or start using pcapng now ?!?

I can definitely create some trace files, either synthetic or real (with
ntar). A friend of mine developed a simple app to convert libpcap files
pcap-ng files. I need to have a look at it. It depends if you want simple
captures or something using the various features of pcap-ng (multiple
interfaces, multiple sections, different byte order in the file).

Some simple example files would be enough, it's only to find a starting
point (but I'm not in a hurry about that).
Sure, I will do that in a couple days.

Attached you can find a sample trace file (http.cap) taken from the 
wireshark wiki, and the same capture converted into ntar (http.cap.ntar). 
The ntar file was generated on my XP laptop, so the byte order is 
little-endian. Also, it contains one section only. If you want a big-endian 
file or a file with multiple sections, just let me know.
Have a nice day

Attachment: http.cap.ntar
Description: Binary data

Attachment: http.cap
Description: Binary data