[pcap-ng-format] Validating a multi-session implementation

[Michael Richardson]

Emery Hemingway <emery at vfemail.net> wrote:
    > This one is a bit novel, its for a microkernel like environment so it
    > can be attached directly to a driver or an application. The utility is
    > aware of the application attaching or detaching from the network
    > (almost always one attachment per process-liftetime), so it seemed
    > natural to split these session into pcapng sessions.

    > My problem now is that my preferred viewer would be wireshark, but this
    > does not support multiple sessions.

Fix wireshark?  Maybe just allow it to show one session at first?
In the interim, I guess a program that could open a pcap-ng multi-session
file and either give one the merged result, or one flow.  wireshark could
popen() that utility.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [