How to use rawshark to analyse a pcap file which is generated by tcpdump?

edit

I've tried -r ,but receive ""./f1528" is neither an interface nor a pipe"

Ah, so rawshark is intended to provide 'realtime' processing of a data stream. Therefore it's not geared to reading already existing capture files. That is just old data. You'll have to feed it otherwise.

One way to do this is using a pipe, like so (reading from stdin):

cat ./f1528 | ./rawshark -s -r - -d encap:EN10MB

Another way it to use a FIFO (in the file system), like so:

mkfifo sharkfin
cat ./f1526 > sharkfin

while in another process (another shell):

./rawshark -s -r sharkfin -d encap:EN10MB

You may want to add some -F options too, to get some field data.

That works, Thank you so much!

I think the documentation could be improved as it certainly reads like a file can passed directly.