On 12/4/06, Gerald Combs <[EMAIL PROTECTED]> wrote:
Harley Stenzel wrote:
> Looking forward, however, it would be helpful if the libpcap file
> format provided a way to tag the source of the captured packet, so
> that merged files do not loose information.
NTAR supports this:
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionpb
It certainly does, but it expired more than 2 years ago. Is it still active?
--Harley
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
