Wireshark-dev: Re: [Wireshark-dev] removing mergecap -T option
From: Hadriel Kaplan <[email protected]>
Date: Fri, 14 Aug 2015 12:30:27 -0400
But isn't that the purpose of editcap?  I'm only talking about
removing it from mergecap.


On Fri, Aug 14, 2015 at 12:26 PM, Pascal Quantin
<[email protected]> wrote:
> Le 14 août 2015 6:18 PM, "Hadriel Kaplan" <[email protected]> a
> écrit :
>> Howdy,
>> Due to some reported bugs and inconsistencies, I'm refactoring the
>> capture file merging code in mergecap.c and file.c's cf_merge_files()
>> - basically gutting them and putting most of the logic into a common
>> "merge_files()" function in merge.c.
>> While merging their function code logic, I noticed that mergecap lets
>> the user set the frame encap type to use for the new output file, with
>> a '-T' option. That seems completely useless to me, since you can't
>> really change the encap type of what was in the original capture
>> files; nor does mergecap seem to do so either, nor does it filter/save
>> only those packet encap types, nor verify that the input files had
>> that, nor really anything useful - all it appears it can accomplish is
>> to produce invalid output files.
>> Does anyone mind if I remove the '-T' option from mergecap?
> Hi Hadriel,
> Please do not remove this option. It allows to fix wrong pcap files
> generated by other tools (see bug 11425 for example).
> Cheers,
> Pascal.
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <[email protected]>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:[email protected]?subject=unsubscribe