I have a hex dump of packets captured on various link types. I use a perl script to split these dumps by link type and then feed each type through text2pcap before running them through mergecap. With text2pcap, I use link types 1, 140, and 141.
text2pcap is churning out pcap files and mergecap creates a pcapng. I need this final merged file to be pcap in order to use it with a playback tool.
When I use the -F pcap option with mergecap it reports "mergecap: The capture file being read can't be written as a "pcap" file."
Any ideas why? Is it due to combining different link types?