splitting pcap file with editcap

asked 2020-12-02 09:24:51 +0000

EricM
1 ●1

I'm looking for information on the file format of the saved split pcap files saved by EditCap. They're saved with a .pcap file extension, but don''t seem to contain the GlobalHeader information in the same format as the original. Is there a different format used before the Record Headers?

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2020-12-02 10:59:47 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

updated 2020-12-02 11:04:13 +0000

From the editcap docs:

Output File(s):
...
  -F <capture type>    set the output file type; default is pcapng.
                       An empty "-F" option will list the file types.

edit flag offensive delete link

Comments

Aha .. thanks for that. I'll head back to the playroom and see if I can make progress..

EricM ( 2020-12-02 11:23:56 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-12-02 09:24:51 +0000

Seen: 781 times

Last updated: Dec 02 '20

splitting pcap file with editcap edit