I'm looking into merging two captures of different encapsulation type for chronological packet analysis. On the current stable version of Wireshark (1.12.4), you are unable to do this via the GUI OR the CLI using mergecap (as mentioned, only if the encap type is different). When using the devel version (1.99.5), I am able to successfully merge two different encapsualtion type captures (802.11+radiotap && ethernet) when using the GUI only. When using mergecap, I obtain the following:
As mentioned, this works fine from the GUI, so I’m not sure if devel version uses mergecap in the background for merges, or something else? If it is something else, do we have the ability to invoke this via CLI for automation purposes? asked 04 May ‘15, 10:59 thisisatestc… edited 04 May ‘15, 13:15 Guy Harris ♦♦ |
One Answer:
This is a bug, for which an ongoing patch is under review here: https://code.wireshark.org/review/#/c/8293/ answered 04 May '15, 14:14 Pascal Quantin |