[pcap-ng-format] Multiple section header blocks

[Erik Hjelmvik]

Hi all,

I'm currently implementing PcapNG support in NetworkMiner, and added
the ability to support multiple Section Header Blocks (so that both
big and little endian frames can coexist in the same file). However,
in order to verify my implementation I'd like to compare my parsing
results to some other tool. I tried opening a pcapng file with
multiple SHB in Wireshark, but it seems this isn't supported in
Wireshark.

My understanding is that it is valid for a pcapng file to contain
multiple SHB. Is this correct?

Do you know of any other tool that supports multuple SHB that I can
use to verify against?

Thanks!

Regards,
Erik

-- 
blog: http://www.netresec.com/?page=Blog
twitter: http://twitter.com/netresec