Question about opening netmon capture file with libpcap

Question

When open a netmon pcap file (file magic GMBU) with the following code snippet, got error message

failed in function pcap_open_offline(): unknown file format

My code snippet:

    libpcapHandler = pcap_open_offline(pcapFile, errbuf);
    if(libpcapHandler == NULL) {
        printf("failed in function pcap_open_offline(): %s\n", errbuf);
        exit(1);
    }

the libpcap library I used is libpcap.so.0.8. It's strange because wireshark 1.10.6 can open this pcap file even though it uses the libpcap too (according to "ldd" command). The OS here is ubuntu 14.04.

Accepted Answer

You assume that libpcap is linked to Wireshark to open these capture files, but it's not. Wireshark uses another library, part of the Wireshark distribution, called wiretap to read all capture file formats. Originally the intend was to make it a super-libpcap, but only it's capture file reading capabilities were developed.