Subject: pcap (tcpdump) files not portable between alpha, 32-bit ports?
To: None <tech-net@netbsd.org>
From: Jonathan Stone <jonathan@DSG.Stanford.EDU>
List: tech-net
Date: 04/14/1999 16:42:13
Greg Oster just sent me a tcpdump trace of a potential tcpdump, taken
on an Alpha running NetBSD.  But tcpdump on all my boxes says it
cannot read the file. Looking further, each record has a timeval
associated with it. My guess is that on the ALpha, the timeval longs
are 64 bits.

Ack. Pfft.

Is this a Known Feature? I thought the libpcap output format was
designed to be portable, cross-platform, etc. 

I dont suppose there's any way we can fix this (e.g,. to use 32-bit
ints in a pcap_timeval and read and write those) without breaking all
existing traces.  Yuck.

Before i hack up code to do the conversion: has anyone else
encountered this and fixed it?  

Also, do the (ex-)LBL folks know about this problem or have any
recommendations/solution/workarounds?