On Jul 20, 2011, at 9:36 AM, Guy Harris wrote:
> The pcap file header is of a fixed length, and if you add a new field
> without, in effect, defining a new pcap format with a new magic number, you
> will end up with files that cannot be read by *any* programs that know the
> old format, such a
On Jul 19, 2011, at 11:48 AM, nicolas roche wrote:
> I wondering if the number of packets loosed by the kernel may be added
> to the .pcap file header.
Not without assigning a new magic number for the new file format.
The pcap file header is of a fixed length, and if you add a new field without
Hello,
I wondering if the number of packets loosed by the kernel may be added
to the .pcap file header.
In fact I'm using tcpdump format to capture and replay physical values
from a detector and this
information is very important to me, so I guess also for other people in
the future.
Thanks for
