Ask Your Question

Revision history [back]

My editcap version is: Editcap 1.10.14

That is a very old version and may not support the options you're using.

From the man page of 4.0.2:

Packet manipulation:
  -s <snaplen>           truncate each packet to max. <snaplen> bytes of data.
  -C [offset:]<choplen>  chop each packet by <choplen> bytes. Positive values
                         chop at the packet beginning, negative values at the
                         packet end. If an optional offset precedes the length,
                         then the bytes chopped will be offset from that value.
                         Positive offsets are from the packet beginning,
                         negative offsets are from the packet end. You can use
                         this option more than once, allowing up to 2 chopping
                         regions within a packet provided that at least 1
                         choplen is positive and at least 1 is negative.
  -L                     adjust the frame (i.e. reported) length when chopping
                         and/or snapping.

So you need to supply either an -s <snaplen> or -C [offset:]<choplen> along with the -L (note upper-case L), e.g. (untested)

editcap -w 0.001 -C 14 -L pcap_file pcap_file_updated