2a3
> # $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $
75a77
> !:mime application/vnd.tcpdump.pcap
139a142
> !:mime application/vnd.tcpdump.pcap
249a253,267
> # "pcap-ng" capture files.
> # http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
> # Pcap-ng files can contain multiple sections. Printing the endianness,
> # snaplen, or other information from the first SHB may be misleading.
> #
> 0 ubelong 0x0a0d0d0a
> >8 ubelong 0x1a2b3c4d pcap-ng capture file
> >>12 beshort x - version %d
> >>14 beshort x \b.%d
> 0 ulelong 0x0a0d0d0a
> >8 ulelong 0x1a2b3c4d pcap-ng capture file
> >>12 leshort x - version %d
> >>14 leshort x \b.%d
>
> #