How to convert Pcapng file to pcap file by Tshark
How to convert Pcapng file to pcap file by Tshark.
You would do
tshark -F pcap -r {pcapng file} -w {pcap file}
Note that not all pcapng files can be converted to pcap files; if the file has interfaces with more than one link-layer header type, and there are packets from interfaces with different link-layer header types, pcap can't support that. TShark will, unfortunately, currently not report that as an error; the packets that have a link-layer header type other than the type of the first packet will not dissect correctly.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2018-01-31 16:11:48 +0000
Seen: 39,722 times
Last updated: Jan 31 '18
Tshark output file problem, saving to csv or txt
tshark: How do I convert pcap to compressed pcapng?
How to donate the development of plugins for Wireshark ?
How to set packet metadata in realtime?
What is the syntax for wireshark custom column
Deduplication in tshark -T ek [closed]
filtering out protocol, sequence number, and ack using tshark
Using tshark filters to extract only interesting traffic from 12GB trace