Wireshark-dev: Re: [Wireshark-dev] removing mergecap -T option
From: Pascal Quantin <[email protected]>
Date: Fri, 14 Aug 2015 18:26:30 +0200


Le 14 août 2015 6:18 PM, "Hadriel Kaplan" <[email protected]> a écrit :
>
> Howdy,
> Due to some reported bugs and inconsistencies, I'm refactoring the
> capture file merging code in mergecap.c and file.c's cf_merge_files()
> - basically gutting them and putting most of the logic into a common
> "merge_files()" function in merge.c.
>
> While merging their function code logic, I noticed that mergecap lets
> the user set the frame encap type to use for the new output file, with
> a '-T' option. That seems completely useless to me, since you can't
> really change the encap type of what was in the original capture
> files; nor does mergecap seem to do so either, nor does it filter/save
> only those packet encap types, nor verify that the input files had
> that, nor really anything useful - all it appears it can accomplish is
> to produce invalid output files.
>
> Does anyone mind if I remove the '-T' option from mergecap?
>

Hi Hadriel,

Please do not remove this option. It allows to fix wrong pcap files generated by other tools (see bug 11425 for example).

Cheers,
Pascal.