[pcap-ng-format] Multiple section header blocks

[Anders Broman]

>-----Original Message-----
>From: pcap-ng-format-bounces at winpcap.org [mailto:pcap-ng-format-bounces at winpcap.org] On Behalf Of Carpenter, 
>Brandon J
>Sent: den 1 november 2012 17:35
>To: Pcap-ng file format
>Subject: Re: [pcap-ng-format] Multiple section header blocks
>
>Erik,
>
>It is perfectly valid to have multiple SHBs in a single PCAP-NG file, however, Wireshark currently supports 
>only a single section header block.  I was working on improvements to Wireshark PCAP-NG handling several months >ago with support for multiple section header blocks (among other things).  The work is not complete, and I hope >to get back to it soon, but I can send you a patch for what I have.
>
>Brandon

Adding that patch to a bug report at https://bugs.wireshark.org might be a good idea so others can take a look
At it too. 

Regards
Anders


On 11/01/2012 05:27 AM, Erik Hjelmvik wrote:
> Hi all,
>
> I'm currently implementing PcapNG support in NetworkMiner, and added 
> the ability to support multiple Section Header Blocks (so that both 
> big and little endian frames can coexist in the same file). However, 
> in order to verify my implementation I'd like to compare my parsing 
> results to some other tool. I tried opening a pcapng file with 
> multiple SHB in Wireshark, but it seems this isn't supported in 
> Wireshark.
>
> My understanding is that it is valid for a pcapng file to contain 
> multiple SHB. Is this correct?
>
> Do you know of any other tool that supports multuple SHB that I can 
> use to verify against?
>
> Thanks!
>
> Regards,
> Erik
>

_______________________________________________
pcap-ng-format mailing list
pcap-ng-format at winpcap.org
https://www.winpcap.org/mailman/listinfo/pcap-ng-format