On May 5, 2011, at 1:38 PM, Darren Reed wrote: > In terms of pcap, I'm becoming more and more of the opinion that DLT_PPI > should not be used for anything other than DLT_IEEE802_11.
Sounds good to me. > Why am I not very interested in pcap-ng? > "The pcapng file format specification is still work in progress, see:" > > ... moving target. pcap-ng is extensible, so it's *always* going to be a moving target. However, both Wireshark and libpcap read it, so there are limits on how much it can move; the spec needs to be clarified to indicate what part isn't going to change and what part is.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
