Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

You would do

tshark -F pcap -r {pcapng file} -w {pcap file}

Note that not all pcapng files can be converted to pcap files; if the file has interfaces with more than one link-layer header type, and there are packets from interfaces with different link-layer header types, pcap can't support that. TShark will, unfortunately, currently not report that as an error; the packets that have a link-layer header type other than the type of the first packet will not dissect correctly.