As we might use cf->lnk_t while a capture is in progress, we need up

update it after each burst of packets.  (This is broken - we should have
cf->lnk_t be WTAP_ENCAP_PER_PACKET in all capture file formats that can
handle more than one packet type, and, in order to support writing out
*some* such files in formats that can only handle one packet type, just
use the type of the first packet when doing a one-pass operation and
gather up all the packet types in a multi-pass operation.)

svn path=/trunk/; revision=43048

1 files changed, 6 insertions, 4 deletions

diff --git a/file.c b/file.c
index 62de66970a..6646e3abc8 100644
--- a/file.c
+++ b/file.c
@@ -838,6 +838,10 @@ cf_continue_tail(capture_file *cf, volatile int to_read, int *err)
     to_read--;
   }
 
+  /* Update the file encapsulation; it might have changed based on the
+     packets we've read. */
+  cf->lnk_t = wtap_file_encap(cf->wth);
+
   /* Cleanup and release all dfilter resources */
   if (dfcode != NULL){
     dfilter_free(dfcode);
@@ -956,10 +960,8 @@ cf_finish_tail(capture_file *cf, int *err)
    * don't need after the sequential run-through of the packets. */
   postseq_cleanup_all_protocols();
 
-  /* Set the file encapsulation type now; we don't know what it is until
-     we've looked at all the packets, as we don't know until then whether
-     there's more than one type (and thus whether it's
-     WTAP_ENCAP_PER_PACKET). */
+  /* Update the file encapsulation; it might have changed based on the
+     packets we've read. */
   cf->lnk_t = wtap_file_encap(cf->wth);
 
   if (*err != 0) {