>>>>> "der" == der Mouse <mouse@Rodents.Montreal.QC.CA> writes:
    der> I had occasion, today, to move a tcpdump packet file (written with
    der> tcpdump -w) from NetBSD/alpha to NetBSD/sparc.  Trying to read it on
    der> the SPARC with tcpdump -r produced a "bogus savefile header" whine.

    der> On inspecting the file manually and reading the source to libpcap, I
    der> found that there's a "struct timeval" in struct pcap_pkthdr, which
    der> occupies twice as much space on /alpha as on /sparc.  Since this is
    der> written directly to the file, it renders the file nonportable.

  I think that Itojun had imported the 0.5.x libpcap from tcpdump.org into
NetBSD 1.5, which does fix this by standardizing on two 32-bit values rather
than a struct timeval. A future rev of libpcap format will likely include
support for 64-bit time. It may be that ethereal's reader can convert your
files.

] Train travel features AC outlets with no take-off restrictions|gigabit is no[
]   Michael Richardson, Solidum Systems   Oh where, oh where has|problem  with[
]     mcr@solidum.com   www.solidum.com   the little fishy gone?|PAX.port 1100[
] panic("Just another NetBSD/notebook using, kernel hacking, security guy");  [