On Apr 26, 2010, at 1:24 PM, p2m p2m wrote:
> I need to capture iSCSI packets (using tshark) and then open the capture files and get the data I need using a dissector to analise it.
Wireshark's capture files are in pcap format, so libpcap/WinPcap can also be used to read the raw packet data. libpcap/WinPcap are documented, and have a standard stable API for reading capture files, unlike Wiretap, whose API is subject to incompatible change.
Note that libpcap/Winpcap *AND* Wiretap both just give you raw packet data; they do not do *any* dissection.
