From: Ghislain Mary <nospam@...>
Date: 2005-04-14T08:15:11+09:00
Subject: Re: Status of libpcap

Hi,

Martin Pirker a 辿crit :
> Jonathan Paisley <jp-www@dcs.gla.ac.uk> wrote:
> 
>>I've used that library and linked against libpcap 0.8.3. I don't think the
>>libpcap API has changed much.
> 
> 
> A dumpfile of e.g. Ethereal sometimes causes exceptions when opened by
> Pcap::Capture.open_offline, seems some new structures are not (yet)
> handled by the Ruby bindings.
> 

Yes, that's exactly the problem I'm having. I try to load a capture of 
IEEE802.11 frames with prism headers. Opening my capture file with 
Pcap::Capture.open_offline and trying to iterate over each packets I get 
a PcapError telling me "Unknow data-link type 119" which corresponds to 
the libcap constant DLT_PRISM_HEADER. So I have managed to define this 
constant in ruby-pcap. But that is not sufficient. But as it is done for 
now, in packet.c the struct datalinks suppose that the ids of the 
different datalinks types are incremented by 1, whereas this is not the 
case, having gaps between different constants in the libpcap. So it 
looks like that this is not that easy to make it work. I'll keep telling 
here what I find, and if someone could help me that would be wery cool :)

Ghislain