I noticed that 1.0.x versions of wireshark don't support writing
non-Ethernet pcapng files. However, other then explicitly forbidding
it in pcapng_dump_can_write_encap() in wiretap/pcapng.c I can't see
any reason for this- the link_type field seems to be correctly
read/written.
I commented out the check, and did a test (Cisco HDLC) and had no
problem reading a standard pcap file and converting it to pcapng.
Am I missing something?
--
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
-- Benjamin Franklin
