RE: [Ethereal-users] How to read an Ethereal file?

[Richard Urwin <RUrwin@xxxxxxxxxxxxx>]

Guy Harris said:
> "The packet data" is raw packet data, starting with a link-layer header.
> You will have to write your own code to interpret that data; libpcap
> will *not* do it for you.  You will have to write your own code to
> extract link-layer source and destination addresses, and to extract the
> packet type and use that to determine whether to analyze the rest of the
> packet as an IP packet, or an ARP packet, or....  You will also have to
> write your own code to interpret the IP header, and so on.


Alternatively, use ethereal/tethereal to print a capture to a file and then
write a program to analyse that. You will not get all the details of the
packets, but you can tune the print to only show those bits that you are
interested in.

-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx


________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________