Re: Nettl HP-UX

[Andrej van der Zee <andrejvanderzee () gmail com>]

> If you're willing to modify editcap, you could try making a special modified version of it that maps 
> WTAP_ENCAP_NETTL_RAW_IP and WTAP_ENCAP_NETTL_ETHERNET to WTAP_ENCAP_RAW_IP, and, for WTAP_ENCAP_NETTL_ETHERNET 
> packets, discards non-IP packets (don't write them out) and strips off the first 14 bytes of packet data.

Thanks for your help, I got a working version now converting to
pcap-format with encapsulation type for Ethernet, generating a bogus
ether header for type IPv4. In the end it was just a few lines of code
in libpcap.c and pcap-common.c.

Cheers,
Andrej
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe