I have a capture format that has slightly more information than
the standard libpcap format (I keep a flag to tell whether the packet
is coming in the interface or going out, and have a different header
as well.)
I plan to write a small utility that converts my format to
the standard libpcap format...
I see the pcap header in /usr/include/pcap.h, but I am curious
what the 'normal' values are for things like:
bpf_u_int32 magic;
u_short version_major;
u_short version_minor;
Thanks,
Ben
--
Ben Greear <[EMAIL PROTECTED]> <Ben_Greear AT excite.com>
President of Candela Technologies Inc http://www.candelatech.com
ScryMUD: http://scry.wanfear.com http://scry.wanfear.com/~greear
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]
