C.5. editcap: Edit capture files

Included with Ethereal is a small utility called editcap, which is a command-line utility for working with capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as print information about capture files.

Example C.2. Help information available from editcap

	
$ editcap.exe -h
Usage: editcap [-r] [-h] [-v] [-T <encap type>] [-E <probability>]
               [-F <capture type>]> [-s <snaplen>] [-t <time adjustment>]
               <infile> <outfile> [ <record#>[-<record#>] ... ]
  where
        -E <probability> specifies the probability (between 0 and 1)
            that a particular byte will will have an error.
        -F <capture type> specifies the capture file type to write:
            libpcap - libpcap (tcpdump, Ethereal, etc.)
            rh6_1libpcap - RedHat Linux 6.1 libpcap (tcpdump)
            suse6_3libpcap - SuSE Linux 6.3 libpcap (tcpdump)
            modlibpcap - modified libpcap (tcpdump)
            nokialibpcap - Nokia libpcap (tcpdump)
            lanalyzer - Novell LANalyzer
            ngsniffer - Network Associates Sniffer (DOS-based)
            snoop - Sun snoop
            netmon1 - Microsoft Network Monitor 1.x
            netmon2 - Microsoft Network Monitor 2.x
            ngwsniffer_1_1 - Network Associates Sniffer (Windows-based) 1.1
            ngwsniffer_2_0 - Network Associates Sniffer (Windows-based) 2.00x
            nettl - HP-UX nettl trace
            visual - Visual Networks traffic capture
            5views - Accellent 5Views capture
            niobserverv9 - Network Instruments Observer version 9
            default is libpcap
        -h produces this help listing.
        -r specifies that the records specified should be kept, not deleted,
                           default is to delete
        -s <snaplen> specifies that packets should be truncated to
           <snaplen> bytes of data
        -t <time adjustment> specifies the time adjustment
           to be applied to selected packets
        -T <encap type> specifies the encapsulation type to use:
            ether - Ethernet
            tr - Token Ring
            slip - SLIP
            ppp - PPP
            fddi - FDDI
            fddi-swapped - FDDI with bit-swapped MAC addresses
            rawip - Raw IP
            arcnet - ARCNET
            arcnet_linux - Linux ARCNET
            atm-rfc1483 - RFC 1483 ATM
            linux-atm-clip - Linux ATM CLIP
            lapb - LAPB
            atm-pdus - ATM PDUs
            atm-pdus-untruncated - ATM PDUs - untruncated
            null - NULL
            ascend - Lucent/Ascend access equipment
            isdn - ISDN
            ip-over-fc - RFC 2625 IP-over-Fibre Channel
            ppp-with-direction - PPP with Directional Info
            ieee-802-11 - IEEE 802.11 Wireless LAN
            prism - IEEE 802.11 plus Prism II monitor mode header
            ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
            ieee-802-11-radiotap - IEEE 802.11 plus radiotap WLAN header
            ieee-802-11-avs - IEEE 802.11 plus AVS WLAN header
            linux-sll - Linux cooked-mode capture
            frelay - Frame Relay
            frelay-with-direction - Frame Relay with Directional Info
            chdlc - Cisco HDLC
            ios - Cisco IOS internal
            ltalk - Localtalk
            pflog-old - OpenBSD PF Firewall logs, pre-3.4
            hhdlc - HiPath HDLC
            docsis - Data Over Cable Service Interface Specification
            cosine - CoSine L2 debug log
            whdlc - Wellfleet HDLC
            sdlc - SDLC
            tzsp - Tazmen sniffer protocol
            enc - OpenBSD enc(4) encapsulating interface
            pflog - OpenBSD PF Firewall logs
            chdlc-with-direction - Cisco HDLC with Directional Info
            bluetooth-h4 - Bluetooth H4
            mtp2 - SS7 MTP2
            mtp3 - SS7 MTP3
            irda - IrDA
            user0 - USER 0
            user1 - USER 1
            user2 - USER 2
            user3 - USER 3
            user4 - USER 4
            user5 - USER 5
            user6 - USER 6
            user7 - USER 7
            user8 - USER 8
            user9 - USER 9
            user10 - USER 10
            user11 - USER 11
            user12 - USER 12
            user13 - USER 13
            user14 - USER 14
            user15 - USER 15
            symantec - Symantec Enterprise Firewall
            ap1394 - Apple IP-over-IEEE 1394
            bacnet-ms-tp - BACnet MS/TP
            raw-icmp-nettl - Raw ICMP with nettl headers
            raw-icmpv6-nettl - Raw ICMPv6 with nettl headers
            gprs-llc - GPRS LLC
            juniper-atm1 - Juniper ATM1
            juniper-atm2 - Juniper ATM2
            redback - Redback SmartEdge
            rawip-nettl - Raw IP with nettl headers
            ether-nettl - Ethernet with nettl headers
            tr-nettl - Token Ring with nettl headers
            fddi-nettl - FDDI with nettl headers
            unknown-nettl - Unknown link-layer type with nettl headers
            mtp2-with-phdr - MTP2 with pseudoheader
            juniper-pppoe - Juniper PPPoE
            gcom-tie1 - GCOM TIE1
            gcom-serial - GCOM Serial
            x25-nettl - X25 with nettl headers
            default is the same as the input file
        -v specifies verbose operation, default is silent

            A range of records can be specified as well
      

Where each option has the following meaning:

-r

This option specifies that the frames listed should be kept, not deleted. The default is to delete the listed frames.

-h

This option provides help.

-v

This option specifies verbose operation. The default is silent operation.

-T {encap type}

This option specifies the frame encapsulation type to use.

It is mainly for converting funny captures to something that Ethereal can deal with.

The default frame encapsulation type is the same as the input encapsulation.

-F {capture type}

This option specifies the capture file format to write the output file in.

The default is libpcap format.

-s {snaplen}

Specifies that packets should be truncated to {snaplen} bytes of data.

-t {time adjustment}

Specifies the time adjustment to be applied to selected packets.

{infile}

This parameter specifies the input file to use. It must be present.

{outfile}

This parameter specifies the output file to use. It must be present.

[record#[-][record# ...]]

This optional parameter specifies the records to include or exclude (depending on the -r option. You can specify individual records or a range of records.