1 | initial version |
My editcap version is: Editcap 1.10.14
That is a very old version and may not support the options you're using.
From the man page of 4.0.2:
Packet manipulation:
-s <snaplen> truncate each packet to max. <snaplen> bytes of data.
-C [offset:]<choplen> chop each packet by <choplen> bytes. Positive values
chop at the packet beginning, negative values at the
packet end. If an optional offset precedes the length,
then the bytes chopped will be offset from that value.
Positive offsets are from the packet beginning,
negative offsets are from the packet end. You can use
this option more than once, allowing up to 2 chopping
regions within a packet provided that at least 1
choplen is positive and at least 1 is negative.
-L adjust the frame (i.e. reported) length when chopping
and/or snapping.
So you need to supply either an -s <snaplen>
or -C [offset:]<choplen>
along with the -L
(note upper-case L), e.g. (untested)
editcap -w 0.001 -C 14 -L pcap_file pcap_file_updated