When processing pcapng
file which have multiple interfaces, you may meet following errors:
pcap_next_ex() [an interface has a snapshot length 262144 different from the type of the first interface]
Then capinfos
shows you there are multiple interfaces with different capture lengths:
$ capinfos test.pcapng
File name: test.pcapng
File type: Wireshark/... - pcapng
......
Number of interfaces in file: 2
Interface #0 info:
Encapsulation = Ethernet (1 - ether)
Capture length = 1600
Time precision = microseconds (6)
Time ticks per second = 1000000
Number of stat entries = 0
Number of packets = 2474
Interface #1 info:
Encapsulation = Ethernet (1 - ether)
Capture length = 262144
Time precision = microseconds (6)
Time ticks per second = 1000000
Number of stat entries = 0
Number of packets = 13
One solution is to convert the pcapng
to pcap
file, then libpcap
can process it:
tshark -F pcap -r test.pcapng -w test.pcap