Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13
From: Anders Broman <[email protected]>
Date: Mon, 13 May 2013 07:57:20 +0200
Guy Harris skrev 2013-05-12 00:52:
On May 2, 2013, at 9:25 AM, Anders Broman <[email protected]> wrote:

Alternatively if the file is rewritten on the first pass writing the reassembled data together with the packet holding the last fragment the reassembled data could be read together with the packet
But that might have other problems and might require changes to the file format description (pcap-ng)
Not all capture files are pcap-ng files.

Not all the capture files that aren't pcap-ng files are pcap files.

Not all the capture files that are neither pcap-ng files nor pcap files have link-layer header types supported by pcap or pcap-ng.

Anything that assumes that capture files are all pcap or pcap-ng won't work.
So either this is a bad idea, don't pursue it or everything we can read we should be able to write in pcap-ng as a temporary file at least. Depending on what's most important file support could be dropped until
it could be represented in pcap-ng.

Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
              mailto:[email protected]?subject=unsubscribe