Re: [Wireshark-dev] Does it make any sense to supply Radiotap + 802.11 headers for packets captured on wireless adapter for managed mode?

2016-04-26 Thread Guy Harris
On Apr 24, 2016, at 8:33 PM, Yang Luo wrote: > On Mon, Apr 25, 2016 at 7:56 AM, Guy Harris wrote: >> On Apr 19, 2016, at 7:24 PM, Yang Luo wrote: >> >>> First there's a little background here: Npcap uses a build-time >>> configuration to choose whether the driver sees fake Ethernet packets or

Re: [Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Martin Mathieson
On Tue, Apr 26, 2016 at 6:25 PM, Guy Harris wrote: > On Apr 26, 2016, at 8:01 AM, Martin Mathieson > wrote: > >> I had a need to convert a file with RAW_IP encap to ETHERNET encap >> today, so I tried >> >> editcap -T ether rawip.cap ethernet.pcap >> >> This did change the encap but didn't write

Re: [Wireshark-dev] Does it make any sense to supply Radiotap + 802.11 headers for packets captured on wireless adapter for managed mode?

2016-04-26 Thread Graham Bloice
On 25 April 2016 at 04:33, Yang Luo wrote: > Hi Guy, > > On Mon, Apr 25, 2016 at 7:56 AM, Guy Harris wrote: > >> On Apr 19, 2016, at 7:24 PM, Yang Luo wrote: >> >> > First there's a little background here: Npcap uses a build-time >> configuration to choose whether the driver sees fake Ethernet

Re: [Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Guy Harris
On Apr 26, 2016, at 8:01 AM, Martin Mathieson wrote: > I had a need to convert a file with RAW_IP encap to ETHERNET encap > today, so I tried > > editcap -T ether rawip.cap ethernet.pcap > > This did change the encap but didn't write a fake ethernet header > (apologies if this was fixed recent

[Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Martin Mathieson
Hi, I had a need to convert a file with RAW_IP encap to ETHERNET encap today, so I tried editcap -T ether rawip.cap ethernet.pcap This did change the encap but didn't write a fake ethernet header (apologies if this was fixed recetly, my snapshot here is a couple of months old). I was able to co