Ask Your Question
0

mergecap won't write pcap

asked 2020-10-03 00:06:18 +0000

sigtraniac gravatar image

I have a hex dump of packets captured on various link types. I use a perl script to split these dumps by link type and then feed each type through text2pcap before running them through mergecap. With text2pcap, I use link types 1, 140, and 141.

text2pcap is churning out pcap files and mergecap creates a pcapng. I need this final merged file to be pcap in order to use it with a playback tool.

When I use the -F pcap option with mergecap it reports "mergecap: The capture file being read can't be written as a "pcap" file."

Any ideas why? Is it due to combining different link types?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-10-03 02:20:15 +0000

Chuckc gravatar image

updated 2020-10-03 02:20:32 +0000

Have you checked the mergecap man page ?

The output file frame encapsulation type is set to the type of the input files if all input files have the same type. If not all of the input files have the same frame encapsulation type, the output file type is set to WTAP_ENCAP_PER_PACKET. Note that some capture file formats, most notably pcap, do not currently support WTAP_ENCAP_PER_PACKET. This combination will cause the output file creation to fail.
edit flag offensive delete link more

Comments

I.e., if you're merging multiple pcap files with different link types, you cannot write that out as a pcap file, only as a pcapng file. pcap supports only one link type per file.

Guy Harris gravatar imageGuy Harris ( 2020-10-03 02:58:56 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-10-03 00:06:18 +0000

Seen: 1,321 times

Last updated: Oct 03 '20