Subject: Re: libpcap - not MI?
To: None <firstname.lastname@example.org>
From: der Mouse <mouse@Rodents.Montreal.QC.CA>
Date: 02/07/2001 15:57:40
> I think that Itojun had imported the 0.5.x libpcap from tcpdump.org
> into NetBSD 1.5, which does fix this by standardizing on two 32-bit
> values rather than a struct timeval.
> A future rev of libpcap format will likely include support for 64-bit
> time. It may be that ethereal's reader can convert your files.
Oh, converting the files was no problem, once I saw what was going on.
I've already written a program which converts pcap dump files to
"native" word size, based on the struct timeval format (and native
endianness, while I was at it). Of course, it'll be unnecessary once I
fix up libpcap...but it was a simple quick hack to render the file
readable in the meantime. :-)
7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B