Hello,
I'm looking to build a Pcapng parser. As such I need to programatically determine how large the Section Header Block, and in essence, reverse engineer my parser from raw data. Pcap files were easy, the general header was 24 bytes at the beginning of each file, and the file header was 16 bytes, that's it. It seems that, after reading the 40 page whitepaper on Pcapng, that it's going to be a little tougher.
How do I enable seeing as much information regarding Pcapng data on Wireshark? I'm looking at a Pcapng file right now, but can't tell anything Pcapng related about it.
Would appreciate the help.