Ask Your Question
0

Usage of editcap --novlan

asked 2021-12-09 00:33:49 +0000

7ACE gravatar image

Hello,

On Windows 10,using editcap,How to get a result when using '--novlan' ?

$ editcap -V
Editcap (Wireshark) 3.6.0 (v3.6.0-0-g3a34e44d02c9)

$ editcap
Duplicate packet removal:
--novlan               remove vlan info from packets before checking for duplicates.

$ editcap --novlan test1.pcapng test2.pcapng
No change in the test2.pcapng

test1.pcapng
Frame 1: 116 bytes on wire (928 bits), 112 bytes captured (896 bits)
Ethernet II, Src: Cisco_a5:3b:71 (00:2a:6a:a5:3b:71), Dst: Cisco_9f:f0:0e (00:00:0c:9f:f0:0e)
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 3101
Internet Protocol Version 4, Src: 10.1.3.212, Dst: 10.1.1.11
User Datagram Protocol, Src Port: 42468, Dst Port: 902
Data (66 bytes)

Regards, 7ACE

edit retag flag offensive close merge delete

Comments

editcap: flag for ignore vlan duplication removal

Perhaps there are no duplicates after the vlan info is removed?
What are your trying to get out?

Chuckc gravatar imageChuckc ( 2021-12-09 01:02:39 +0000 )edit

Sorry,yes,there are no duplicates in 'test1.pcapng' ,i only want to remove vlan info . if no duplicate , does it work?

7ACE gravatar image7ACE ( 2021-12-09 03:44:42 +0000 )edit

1 Answer

Sort by » oldest newest most voted
0

answered 2021-12-09 04:55:21 +0000

Chuckc gravatar image

Are you looking to write a script or could it be done with a Gui tool like TraceWrangler?

The editcap man page has this example:

"To remove vlan tags from all packets within an Ethernet-encapsulated capture file, use:"

editcap -L -C 12:4 capture_vlan.pcapng capture_no_vlan.pcapng
edit flag offensive delete link more

Comments

Thank you so much for the clear explanation!

7ACE gravatar image7ACE ( 2021-12-09 05:15:05 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-12-09 00:33:49 +0000

Seen: 353 times

Last updated: Dec 09 '21