Apologies for the thread hijacking...
For what it's worth, I've just had a play with the latest build of CommView (6.5, build 734), and it seems to have basic support for writing PCAP-NG files. (Emits no packet comments, and doesn't use any nifty features like storing application/machine info).
Since I haven't got a tool for reverse-engineering PCAP-NG traces handy (other than looking at strings in a text editor), I'm assuming that they're generating very bare-bones IDBs, and using (Simple?) Packet Blocks for storing the packet data. I don't know if it'll preserve unrecognised block/field types, or comments, either.
From testing with some of the traces that I've attached to bug reports related to CommView .NCF support in Wireshark, it seems that I can export Ethernet packets with full fidelity; although exporting 802.11 captures is a lossy process (the RSSI, band/frequency, and bandwidth/link speed field values are lost).
In fact, it seems that even though the .NCF format supports multiple link layer types (and converting 802.11-only captures works fine), attempting to export a sample file containing 802.11, Ethernet, and Token Ring packets to PCAP-NG results in a useless file with all of the packets assigned to a single interface with an Ethernet link type.
So I guess that it's a good start from the TamoSoft folks - but they've got a little more work to do, before they can call their product fully-interoperable with PCAP-NG.
I still don't know if any of MS's offerings support writing files in this format, though.
Tyson.
