 | 1 | initial version |
You would do
tshark -F pcap -r {pcapng file} -w {pcap file}
Note that not all pcapng files can be converted to pcap files; if the file has interfaces with more than one link-layer header type, and there are packets from interfaces with different link-layer header types, pcap can't support that. TShark will, unfortunately, currently not report that as an error; the packets that have a link-layer header type other than the type of the first packet will not dissect correctly.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.