Hi all,
can anyone tell me when Wireshark/Dumpcap will actually write a Name
Resolution Block to a pcapng file? I have a file written with an older
dumpcap version (I guess it was pre 1.8) that contains a NRB but the
latest 1.9 build doesn't seem to do that at all.
I tried with DNS queries enabled, and even edited a hosts file to see
under which circumstances the resulting pcapng file would contain a
NRB. It didn't work, no matter what I tried. Is it possible that the
code writing this kind of block is not being called anymore?
I'd expect Wireshark to write a NRB containing all records whenever a
name resolution is not coming from DNS packets contained in a file
(which would make it reproducable when opening the file, even without
the NRB).
Thanks,
Jasper
