Howdy,
Due to some reported bugs and inconsistencies, I'm refactoring the
capture file merging code in mergecap.c and file.c's cf_merge_files()
- basically gutting them and putting most of the logic into a common
"merge_files()" function in merge.c.
While merging their function code logic, I noticed that mergecap lets
the user set the frame encap type to use for the new output file, with
a '-T' option. That seems completely useless to me, since you can't
really change the encap type of what was in the original capture
files; nor does mergecap seem to do so either, nor does it filter/save
only those packet encap types, nor verify that the input files had
that, nor really anything useful - all it appears it can accomplish is
to produce invalid output files.
Does anyone mind if I remove the '-T' option from mergecap?
-hadriel
