>If the file you have in front of you is "with WTAP_ENCAP 42", then it's either:
>1) a pcap file with a link-layer encapsulation type of 140 (LINKTYPE_MTP2/DLT_MTP2)
>or
>2) a pcap-ng file all the interfaces of which have a link-layer encapsulation type of 140 (LINKTYPE_MTP2/DLT_MTP2).
>It's definitely not an rf5 file, as they all are given a WTAP_ENCAP_ value of WTAP_ENCAP_K12 by Wireshark.
I have several captures. One of them is definitely in rf5 format, another one is definitely in pcap format. What I meant is that from looking at supported DLT_TYPEs and then WTAP_ENCAP (sets of supported encapsulations are different) it appeared to me that development of wireshark and tcereplay happens totally independent from each other -- previously I thought/hoped that it happens in more coordinated way.
That is why I asked then:
Does it mean that the development of wireshark/wiretap
and tcpreplay happens in totally independent way?
in order to be sure that this is indeed what (somewhat sadly) happens.
So, looks like I will have to delve deeper in this DLT plugin stuff.
/wbr
Ariel Burbaickij
