What good can these two flags make together? I.e. reading a capture with DLT_NULL frames trying to interpret then as DLT_EN10MB doesn't work. Should it?
AFAICS a legitimate use would be to read one datalink type and try to write out a capture with another DLT. E.g. windump -r null_dlt.pcap -y en10mb -w en10mb_dlt.pcap But again, it doesn't do what I expect; the files are exactly the same. Maybe tcpdump should flag it as an error using -y and -r flags together ?? Gisle V. # rm /bin/laden /bin/laden: Not found - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
