mergecap won't write pcap

asked 2020-10-03 00:06:18 +0000

sigtraniac
7 ●1 ●1 ●3

I have a hex dump of packets captured on various link types. I use a perl script to split these dumps by link type and then feed each type through text2pcap before running them through mergecap. With text2pcap, I use link types 1, 140, and 141.

text2pcap is churning out pcap files and mergecap creates a pcapng. I need this final merged file to be pcap in order to use it with a playback tool.

When I use the -F pcap option with mergecap it reports "mergecap: The capture file being read can't be written as a "pcap" file."

Any ideas why? Is it due to combining different link types?

answered 2020-10-03 02:20:15 +0000

Chuckc
3023 ●6 ●611 ●20

updated 2020-10-03 02:20:32 +0000

Have you checked the mergecap man page ?

The output file frame encapsulation type is set to the type of the input files if all input files have the same type. If not all of the input files have the same frame encapsulation type, the output file type is set to WTAP_ENCAP_PER_PACKET. Note that some capture file formats, most notably pcap, do not currently support WTAP_ENCAP_PER_PACKET. This combination will cause the output file creation to fail.

edit flag offensive delete link

Comments

I.e., if you're merging multiple pcap files with different link types, you cannot write that out as a pcap file, only as a pcapng file. pcap supports only one link type per file.

Guy Harris ( 2020-10-03 02:58:56 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

mergecap won't write pcap

1 Answer

Comments

Your Answer

Question Tools

Stats

mergecap won't write pcap edit

1 Answer

Comments

Your Answer

Question Tools

Stats

mergecap won't write pcap