On Mar 11, 2008, at 1:15 PM, Stephen Donnelly wrote:
When you save a capture in libpcap format Wireshark doesn't prompt you
for which DLT to use?
No. That's supposed to happen automatically.
How does it decide which DLT is appropriate?
It decides based on the encapsulation type of the input file, e.g. if
the input file has an encapsulation type of WTAP_ENCAP_ETHERNET (as,
for example, a libpcap file with DLT_EN10MB would have), Wireshark
would open the output file with that encapsulation type, which the
libpcap-writing code would map to DLT_EN10MB.
