Pcapng support

Brought to you by: jpr5

#37 Pcapng support

Milestone: None

Status: closed

Owner: Jordan Ritter

Labels: None

Priority: 5

Updated: 2017-09-06

Created: 2012-08-15

Creator: James

Private: No

Doesn't seem like ngrep supports pcapng...can we get this? Thanks.

Discussion

Jordan Ritter - 2012-08-15

assigned_to: nobody --> jpr5
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jordan Ritter - 2012-08-15

Thanks for the report. I'll look into it.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Guy Harris - 2015-04-28

As ngrep uses pcap_open_offline(), with newer versions of libpcap it'll be able to read any pcap-ng file in which all the network interfaces have the same link-layer header type and snapshot length (which includes all pcap-ng captures with only one interface).

Anything more than that would require additional APIs in libpcap and thus code changes to programs using it.

(Yes, I plan to add those APIs at some point, as well as APIs for writing pcap-ng files.)

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jordan Ritter - 2017-09-06

Latest ngrep works with latest libpcap. Whatever incompatibilities there were, I think they've been addressed.

Closing as a stale bug report.

FYI bug reports are managed here now: https://github.com/jpr5/ngrep/issues

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Jordan Ritter - 2017-09-06

status: open --> closed

Group: -->
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.