EDITCAP(1) The Ethereal Network Analyzer EDITCAP(1)NAMEeditcap - Edit and/or translate the format of capture
files
SYNOPSYSeditcap [ -F file format ] [ -T encapsulation type ]
[ -r ] [ -v ] [ -s snaplen ] [ -t time adjustment ] [ -h ]
infile outfile [ record# ... ]
DESCRIPTION
Editcap is a program that reads a saved capture file and
writes some or all of the packets in that capture file to
another capture file. Editcap knows how to read libpcap
capture files, including those of tcpdump, Ethereal, and
other tools that write captures in that format. In
addition, Editcap can read capture files from snoop and
atmsnoop, Shomiti/Finisar Surveyor, Novell LANalyzer,
Network General/Network Associates DOS-based Sniffer
(compressed or uncompressed), Microsoft Network Monitor,
AIX's iptrace, Cinco Networks NetXRay, Network Associates
Windows-based Sniffer, AG Group/WildPackets
EtherPeek/TokenPeek/AiroPeek, RADCOM's WAN/LAN analyzer,
Lucent/Ascend router debug output, HP-UX's nettl, the dump
output from Toshiba's ISDN routers, the output from
i4btrace from the ISDN4BSD project, the output in IPLog
format from the Cisco Secure Intrusion Detection System,
pppd logs (pppdump format), the output from VMS's
TCPIPtrace utility, the text output from the DBS
Etherwatch VMS utility, traffic capture files from Visual
Networks' Visual UpTime and the output from CoSine L2
debug. There is no need to tell Editcap what type of file
you are reading; it will determine the file type by
itself. Editcap is also capable of reading any of these
file formats if they are compressed using gzip. Editcap
recognizes this directly from the file; the '.gz'
extension is not required for this purpose.
By default, it writes the capture file in libpcap format,
and writes all of the packets in the capture file to the
output file. The -F flag can be used to specify the
format in which to write the capture file; it can write
the file in libpcap format (standard libpcap format, a
modified format used by some patched versions of libpcap,
the format used by Red Hat Linux 6.1, or the format used
by SuSE Linux 6.3), snoop format, uncompressed Sniffer
format, Microsoft Network Monitor 1.x format, the format
used by Windows-based versions of the Sniffer software,
and the format used by Visual Networks' software.
A list of packet numbers can be specified on the command
line; the packets with those numbers will not be written
to the capture file, unless the -r flag is specified, in
which case only those packets will be written to the
capture file. Ranges of packet numbers can be specified
as start-end, referring to all packets from start to end
(removing them all if -r isn't specified, including them
all if -r is specified).
If the -s flag is used to specify a snapshot length,
frames in the input file with more captured data than the
specified snapshot length will have only the amount of
data specified by the snapshot length written to the
output file. This may be useful if the program that is to
read the output file cannot handle packets larger than a
certain size (for example, the versions of snoop in
Solaris 2.5.1 and Solaris 2.6 appear to reject Ethernet
frames larger than the standard Ethernet MTU, making them
incapable of handling gigabit Ethernet captures if jumbo
frames were used).
If the -t flag is used to specify a time adjustment, the
specified adjustment will be applied to all selected
frames in the capture file. The adjustment is specified
as [-]seconds[.fractional seconds]. For example, -t 3600
advances the timestamp on selected frames by one hour
while -t -0.5 reduces the timestamp on selected frames by
one-half second. This feature is useful when
synchronizing dumps collected on different machines where
the time difference between the two machines is known or
can be estimated.
If the -T flag is used to specify an encapsulation type,
the encapsulation type of the output capture file will be
forced to the specified type, rather than being the type
appropriate to the encapsulation type of the input capture
file. Note that this merely forces the encapsulation type
of the output file to be the specified type; the packet
headers of the packets will not be translated from the
encapsulation type of the input capture file to the
specified encapsulation type (for example, it will not
translate an Ethernet capture to an FDDI capture if an
Ethernet capture is read and '-T fddi' is specified).
OPTIONS-F Sets the file format of the output capture file.
-T Sets the packet encapsulation type of the output
capture file.
-r Causes the packets whose packet numbers are specified
on the command line to be written to the output
capture file, and no other packets to be written to
the output capture file.
-v Causes editcap to print a number of messages while
it's working.
-s Sets the snapshot length to use when writing the data.
-t Sets the time adjustment to use on selected frames.
-h Prints the version and options and exits.
SEE ALSOtcpdump(8), pcap(3), ethereal(1), mergecap(1)NOTES
Editcap is part of the Ethereal distribution. The latest
version of Ethereal can be found at
http://www.ethereal.com.
AUTHORS
Original Author
-------- ------
Richard Sharpe <sharpe[AT]ns.aus.com>
Contributors
------------
Guy Harris <guy[AT]alum.mit.edu>
9/Mar/2003 0.9.12 EDITCAP(1)
