Wireshark-dev: Re: [Wireshark-dev] wslua: reading raw file?
From: Guy Harris <[email protected]>
Date: Tue, 08 Apr 2008 23:59:00 -0700
Németh Márton wrote:

I started to use wslua and succeed to write a simple dissector on
ethernet level. I created a .pcap header and copied my raw file after
it.

Is it possible using wslua to open a raw file which is not supported
by Wireshark, yet?
Creating a libpcap-format file header and writing after it packets that 
don't have libpcap-format packet headers is a waste of time; if you want 
to write a file that programs that read libpcap format can read, put the 
libpcap-format file header at the beginning of the file and then put 
libpcap-format packet headers in front of the packet data for each 
packet, and if you just want a raw file, just write out the raw file 
without the libpcap-format headers - without libpcap-format per-packet 
headers, the libpcap-format file header won't help you.