Ask Your Question
0

how Can I remove pcap header from pcap file

asked 2018-01-24 09:43:27 +0000

saadouna2402 gravatar image

I want to remove the pcap header from my recorded pcap file to have a binary Ethernet starting with dest. MAC address

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2018-01-24 15:41:14 +0000

sindy gravatar image

updated 2018-01-24 15:41:46 +0000

For each individual packet, you may select any item in the packet dissection pane (clicking on the packet in packet list pane is not enough) and then use File->Export Packet Bytes to save the raw contents of the packet into a file.

Saving multiple packets into a signle file would make little sense even if you did that using some scrip parsing the pcap format because the length is not part of the packet data for all Ethernet packets (or it is rather an exception nowadays to have it there) so it would be difficult to parse such file.

edit flag offensive delete link more

Comments

Hello,

I don't know why but I cannot select the option (export packet bytes) I can see it under Files but I cannot choose it

saadouna2402 gravatar imagesaadouna2402 ( 2018-01-24 15:49:00 +0000 )edit

Have you loaded a capture file?

grahamb gravatar imagegrahamb ( 2018-01-24 16:10:29 +0000 )edit

yes I have

saadouna2402 gravatar imagesaadouna2402 ( 2018-01-24 16:20:42 +0000 )edit

As I wrote - it is not enough to select the packet in the packet list. After doing so, you must also click anywhere into the packet dissection pane (where the contents of the selected packet is displayed in detail) to select any line in there. After doing so, the choice in the File menu becomes available. Note for futurre: it may be a bug so in newer versions this may not be necessary any more.

sindy gravatar imagesindy ( 2018-01-24 19:35:59 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-01-24 09:43:27 +0000

Seen: 74 times

Last updated: Jan 24