D.6. editcap: Edit capture files
Prev | Appendix D. Related command line tools | Next

## D.6. editcap: Edit capture files

Included with Wireshark is a small utility called editcap, which is a command-line utility for working with capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as to print information about capture files.

Example D.3. Help information available from editcap

    $ editcap -h
    Editcap 0.99.6
    Edit and/or translate the format of capture files.
    See http://www.wireshark.org for more information.

    Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]

    A single packet or a range of packets can be selected.

    Packets:
      -C <choplen>           chop each packet at the end by <choplen> bytes
      -d                     remove duplicate packets
      -E <error probability> set the probability (between 0.0 and 1.0 incl.)
                             that a particular packet byte will be randomly changed
      -r                     keep the selected packets, default is to delete them
      -s <snaplen>           truncate packets to max. <snaplen> bytes of data
      -t <time adjustment>   adjust the timestamp of selected packets,
                             <time adjustment> is in relative seconds (e.g. -0.5)
      -A <start time>        don't output packets whose timestamp is before the
                             given time (format as YYYY-MM-DD hh:mm:ss)
      -B <stop time>         don't output packets whose timestamp is after the
                             given time (format as YYYY-MM-DD hh:mm:ss)

    Output File(s):
      -c <packets per file>  split the packet output to different files,
                             with a maximum of <packets per file> each
      -F <capture type>      set the output file type, default is libpcap
                             an empty "-F" option will list the file types
      -T <encap type>        set the output file encapsulation type,
                             default is the same as the input file
                             an empty "-T" option will list the encapsulation types

    Miscellaneous:
      -h                     display this help and exit
      -v                     verbose output

    $ editcap -F
    editcap: option requires an argument -- F
    editcap: The available capture file types for "F":
        libpcap - Wireshark/tcpdump/... - libpcap
        nseclibpcap - Wireshark - nanosecond libpcap
        modlibpcap - Modified tcpdump - libpcap
        nokialibpcap - Nokia tcpdump - libpcap
        rh6_1libpcap - Red Hat 6.1 tcpdump - libpcap
        suse6_3libpcap - SuSE 6.3 tcpdump - libpcap
        5views - Accellent 5Views capture
        dct2000 - Catapult DCT2000 trace (.out format)
        nettl - HP-UX nettl trace
        netmon1 - Microsoft NetMon 1.x
        netmon2 - Microsoft NetMon 2.x
        ngsniffer - NA Sniffer (DOS)
        ngwsniffer_1_1 - NA Sniffer (Windows) 1.1
        ngwsniffer_2_0 - NA Sniffer (Windows) 2.00x
        niobserverv9 - Network Instruments Observer (V9)
        lanalyzer - Novell LANalyzer
        snoop - Sun snoop
        rf5 - Tektronix K12xx 32-bit .rf5 format
        visual - Visual Networks traffic capture

    $ editcap -T
    editcap: option requires an argument -- T
    editcap: The available encapsulation types for "T":
        ether - Ethernet
        tr - Token Ring
        slip - SLIP
        ppp - PPP
        fddi - FDDI
        fddi-swapped - FDDI with bit-swapped MAC addresses
        rawip - Raw IP
        arcnet - ARCNET
        arcnet_linux - Linux ARCNET
        atm-rfc1483 - RFC 1483 ATM
        linux-atm-clip - Linux ATM CLIP
        lapb - LAPB
        atm-pdus - ATM PDUs
        atm-pdus-untruncated - ATM PDUs - untruncated
        null - NULL
        ascend - Lucent/Ascend access equipment
        isdn - ISDN
        ip-over-fc - RFC 2625 IP-over-Fibre Channel
        ppp-with-direction - PPP with Directional Info
        ieee-802-11 - IEEE 802.11 Wireless LAN
        prism - IEEE 802.11 plus Prism II monitor mode header
        ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
        ieee-802-11-radiotap - IEEE 802.11 plus radiotap WLAN header
        ieee-802-11-avs - IEEE 802.11 plus AVS WLAN header
        linux-sll - Linux cooked-mode capture
        frelay - Frame Relay
        frelay-with-direction - Frame Relay with Directional Info
        chdlc - Cisco HDLC
        ios - Cisco IOS internal
        ltalk - Localtalk
        pflog-old - OpenBSD PF Firewall logs, pre-3.4
        hhdlc - HiPath HDLC
        docsis - Data Over Cable Service Interface Specification
        cosine - CoSine L2 debug log
        whdlc - Wellfleet HDLC
        sdlc - SDLC
        tzsp - Tazmen sniffer protocol
        enc - OpenBSD enc(4) encapsulating interface
        pflog - OpenBSD PF Firewall logs
        chdlc-with-direction - Cisco HDLC with Directional Info
        bluetooth-h4 - Bluetooth H4
        mtp2 - SS7 MTP2
        mtp3 - SS7 MTP3
        irda - IrDA
        user0 - USER 0
        user1 - USER 1
        user2 - USER 2
        user3 - USER 3
        user4 - USER 4
        user5 - USER 5
        user6 - USER 6
        user7 - USER 7
        user8 - USER 8
        user9 - USER 9
        user10 - USER 10
        user11 - USER 11
        user12 - USER 12
        user13 - USER 13
        user14 - USER 14
        user15 - USER 15
        symantec - Symantec Enterprise Firewall
        ap1394 - Apple IP-over-IEEE 1394
        bacnet-ms-tp - BACnet MS/TP
        raw-icmp-nettl - Raw ICMP with nettl headers
        raw-icmpv6-nettl - Raw ICMPv6 with nettl headers
        gprs-llc - GPRS LLC
        juniper-atm1 - Juniper ATM1
        juniper-atm2 - Juniper ATM2
        redback - Redback SmartEdge
        rawip-nettl - Raw IP with nettl headers
        ether-nettl - Ethernet with nettl headers
        tr-nettl - Token Ring with nettl headers
        fddi-nettl - FDDI with nettl headers
        unknown-nettl - Unknown link-layer type with nettl headers
        mtp2-with-phdr - MTP2 with pseudoheader
        juniper-pppoe - Juniper PPPoE
        gcom-tie1 - GCOM TIE1
        gcom-serial - GCOM Serial
        x25-nettl - X25 with nettl headers
        k12 - K12 protocol analyzer
        juniper-mlppp - Juniper MLPPP
        juniper-mlfr - Juniper MLFR
        juniper-ether - Juniper Ethernet
        juniper-ppp - Juniper PPP
        juniper-frelay - Juniper Frame-Relay
        juniper-chdlc - Juniper C-HDLC
        juniper-ggsn - Juniper GGSN
        lapd - LAPD
        dct2000 - Catapult DCT2000
        ber - ASN.1 Basic Encoding Rules

Where each option has the following meaning:

-r

  This option specifies that the frames listed should be kept, not deleted. The default is to delete the listed frames.

-h

  This option provides help.

-v

  This option specifies verbose operation. The default is silent operation.

-T {encap type}

  This option specifies the frame encapsulation type to use.

  It is mainly for converting funny captures to something that Wireshark can deal with.

  The default frame encapsulation type is the same as the input encapsulation.

-F {capture type}

  This option specifies the capture file format to write the output file in.

  The default is libpcap format.

-s {snaplen}

  Specifies that packets should be truncated to {snaplen} bytes of data.

-t {time adjustment}

  Specifies the time adjustment to be applied to selected packets.

{infile}

  This parameter specifies the input file to use. It must be present.

{outfile}

  This parameter specifies the output file to use. It must be present.

[record#[-][record# ...]]

  This optional parameter specifies the records to include or exclude (depending on the -r option. You can specify individual records or a range of records.

Prev | Up | Next
D.5. capinfos: Print information about capture files | Home | D.7. mergecap: Merging multiple capture files into one