Are there any plans to support nseclibpcap?
Opened this issue · 3 comments
Unfortunately, I am on an old version of tshark and can't upgrade easily. (so I can't read pcapng). I was wondering if there are plans to support nseclibpcap?
scapy3k reads pcapng files without using external libraries. Could you be more specific what do you miss?
It is my understanding that pcapng and nseclibpcap are two different formats. tshark -F shows them as two different versions.
I think tshark before version 1.9 (or some time around) didn't provide nanosecond precision in pcapng (https://osqa-ask.wireshark.org/questions/43483/why-does-editcap-write-out-nseclibpcap-correctly-with-nanosecond-timestamps-but-not-with-pcapng)
It is not a big issue though. I directly use tshark's filter and python subprocess now.
Nseclibpcap support is in the plan, but not the highest priority at this point.