Tharaneedharan Vilwanathan wrote:
Hi All,
I have a quick question.
The .pcap format allows the packets to be of the same ethernet type,
right? If so, what is the best way to store the packets of different
ethernet types in a file?
Sorry if this is a common question and/or this has been asked already.
Different file types allow different things. PCAP files can contain
only one DLT value.
PCAP-NG files, OTOH, support multiple link types in a given file.
Wireshark has some basic support for them. For more info see:
http://wiki.wireshark.org/Development/PcapNg
I believe there are other file types that Wireshark supports that
support multiple link types.
