D.7. editcap: Edit capture files
Prev | Appendix D. Related command line tools | Next

## D.7. editcap: Edit capture files

Included with Wireshark is a small utility called editcap, which is a command-line utility for working with capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as to print information about capture files.

Example D.5. Help information available from editcap

    Editcap 1.7.0 (SVN Rev 39165 from /trunk)
    Edit and/or translate the format of capture files.
    See http://www.wireshark.org for more information.

    Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]

    <infile> and <outfile> must both be present.
    A single packet or a range of packets can be selected.

    Packet selection:
      -r                     keep the selected packets; default is to delete them.
      -A <start time>        only output packets whose timestamp is after (or equal
                             to) the given time (format as YYYY-MM-DD hh:mm:ss).
      -B <stop time>         only output packets whose timestamp is before the
                             given time (format as YYYY-MM-DD hh:mm:ss).

    Duplicate packet removal:
      -d                     remove packet if duplicate (window == 5).
      -D <dup window>        remove packet if duplicate; configurable <dup window>
                             Valid <dup window> values are 0 to 1000000.
                             NOTE: A <dup window> of 0 with -v (verbose option) is
                             useful to print MD5 hashes.
      -w <dup time window>   remove packet if duplicate packet is found EQUAL TO OR
                             LESS THAN <dup time window> prior to current packet.
                             A <dup time window> is specified in relative seconds
                             (e.g. 0.000001).

               NOTE: The use of the 'Duplicate packet removal' options with
               other editcap options except -v may not always work as expected.
               Specifically the -r, -t or -S options will very likely NOT have the
               desired effect if combined with the -d, -D or -w.

    Packet manipulation:
      -s <snaplen>           truncate each packet to max. <snaplen> bytes of data.
      -C <choplen>           chop each packet by <choplen> bytes. Positive values
                             chop at the packet beginning, negative values at the
                             packet end.
      -t <time adjustment>   adjust the timestamp of each packet;
                             <time adjustment> is in relative seconds (e.g. -0.5).
      -S <strict adjustment> adjust timestamp of packets if necessary to insure
                             strict chronological increasing order. The <strict
                             adjustment> is specified in relative seconds with
                             values of 0 or 0.000001 being the most reasonable.
                             A negative adjustment value will modify timestamps so
                             that each packet's delta time is the absolute value
                             of the adjustment specified. A value of -0 will set
                             all packets to the timestamp of the first packet.
      -E <error probability> set the probability (between 0.0 and 1.0 incl.)
                             that a particular packet byte will be randomly changed.

    Output File(s):
      -c <packets per file>  split the packet output to different files
                             based on uniform packet counts
                             with a maximum of <packets per file> each.
      -i <seconds per file>  split the packet output to different files
                             based on uniform time intervals
                             with a maximum of <seconds per file> each.
      -F <capture type>      set the output file type; default is libpcap.
                             an empty "-F" option will list the file types.
      -T <encap type>        set the output file encapsulation type;
                             default is the same as the input file.
                             an empty "-T" option will list the encapsulation types.

    Miscellaneous:
      -h                     display this help and exit.
      -v                     verbose output.
                             If -v is used with any of the 'Duplicate Packet
                             Removal' options (-d, -D or -w) then Packet lengths
                             and MD5 hashes are printed to standard-out.

Example D.6. Capture file types available from editcap

    $ editcap -F
    editcap: option requires an argument -- F
    editcap: The available capture file types for the "-F" flag are:
        5views - Accellent 5Views capture
        btsnoop - Symbian OS btsnoop
        commview - TamoSoft CommView
        dct2000 - Catapult DCT2000 trace (.out format)
        eyesdn - EyeSDN USB S0/E1 ISDN trace format
        k12text - K12 text file
        lanalyzer - Novell LANalyzer
        libpcap - Wireshark/tcpdump/... - libpcap
        modlibpcap - Modified tcpdump - libpcap
        netmon1 - Microsoft NetMon 1.x
        netmon2 - Microsoft NetMon 2.x
        nettl - HP-UX nettl trace
        ngsniffer - NA Sniffer (DOS)
        ngwsniffer_1_1 - NA Sniffer (Windows) 1.1
        ngwsniffer_2_0 - NA Sniffer (Windows) 2.00x
        niobserverv - Network Instruments Observer
        nokialibpcap - Nokia tcpdump - libpcap
        nseclibpcap - Wireshark - nanosecond libpcap
        nstrace10 - NetScaler Trace (Version 1.0)
        nstrace20 - NetScaler Trace (Version 2.0)
        pcapng - Wireshark - pcapng
        rf5 - Tektronix K12xx 32-bit .rf5 format
        rh6_1libpcap - RedHat 6.1 tcpdump - libpcap
        snoop - Sun snoop
        suse6_3libpcap - SuSE 6.3 tcpdump - libpcap
        visual - Visual Networks traffic capture

Example D.7. Encapsulation types available from editcap

    $ editcap -T
    editcap: option requires an argument -- T
    editcap: The available encapsulation types for the "-T" flag are:
        ap1394 - Apple IP-over-IEEE 1394
        arcnet - ARCNET
        arcnet_linux - Linux ARCNET
        ascend - Lucent/Ascend access equipment
        atm-pdus - ATM PDUs
        atm-pdus-untruncated - ATM PDUs - untruncated
        atm-rfc1483 - RFC 1483 ATM
        bacnet-ms-tp - BACnet MS/TP
        ber - ASN.1 Basic Encoding Rules
        bluetooth-h4 - Bluetooth H4
        bluetooth-h4-linux - Bluetooth H4 with linux header
        bluetooth-hci - Bluetooth without transport layer
        can20b - Controller Area Network 2.0B
        chdlc - Cisco HDLC
        chdlc-with-direction - Cisco HDLC with Directional Info
        cosine - CoSine L2 debug log
        dct2000 - Catapult DCT2000
        docsis - Data Over Cable Service Interface Specification
        dpnss_link - Digital Private Signalling System No 1 Link Layer
        dvbci - DVB-CI (Common Interface)
        enc - OpenBSD enc(4) encapsulating interface
        erf - Endace Record File
        ether - Ethernet
        ether-nettl - Ethernet with nettl headers
        fc2 - Fibre Channel FC-2
        fc2sof - Fibre Channel FC-2 With Frame Delimiter
        fddi - FDDI
        fddi-nettl - FDDI with nettl headers
        fddi-swapped - FDDI with bit-swapped MAC addresses
        flexray - FlexRay
        frelay - Frame Relay
        frelay-with-direction - Frame Relay with Directional Info
        gcom-serial - GCOM Serial
        gcom-tie1 - GCOM TIE1
        gprs-llc - GPRS LLC
        gsm_um - GSM Um Interface
        hhdlc - HiPath HDLC
        i2c - I2C
        ieee-802-11 - IEEE 802.11 Wireless LAN
        ieee-802-11-avs - IEEE 802.11 plus AVS WLAN header
        ieee-802-11-netmon - IEEE 802.11 plus Network Monitor radio header
        ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
        ieee-802-11-radiotap - IEEE 802.11 plus radiotap WLAN header
        ieee-802-16-mac-cps - IEEE 802.16 MAC Common Part Sublayer
        ios - Cisco IOS internal
        ip-over-fc - RFC 2625 IP-over-Fibre Channel
        ipfix - IPFIX
        ipmb - Intelligent Platform Management Bus
        ipnet - Solaris IPNET
        irda - IrDA
        isdn - ISDN
        jfif - JPEG/JFIF
        juniper-atm1 - Juniper ATM1
        juniper-atm2 - Juniper ATM2
        juniper-chdlc - Juniper C-HDLC
        juniper-ether - Juniper Ethernet
        juniper-frelay - Juniper Frame-Relay
        juniper-ggsn - Juniper GGSN
        juniper-mlfr - Juniper MLFR
        juniper-mlppp - Juniper MLPPP
        juniper-ppp - Juniper PPP
        juniper-pppoe - Juniper PPPoE
        juniper-vp - Juniper Voice PIC
        k12 - K12 protocol analyzer
        lapb - LAPB
        lapd - Lapd header
        lapd - LAPD
        layer1-event - EyeSDN Layer 1 event
        lin - Local Interconnect Network
        linux-atm-clip - Linux ATM CLIP
        linux-sll - Linux cooked-mode capture
        ltalk - Localtalk
        most - Media Oriented Systems Transport
        mpeg - MPEG
        mtp2 - SS7 MTP2
        mtp2-with-phdr - MTP2 with pseudoheader
        mtp3 - SS7 MTP3
        mux27010 - MUX27010
        nstrace10 - NetScaler Encapsulation 1.0 of Ethernet
        nstrace20 - NetScaler Encapsulation 2.0 of Ethernet
        null - NULL
        packetlogger - PacketLogger
        pflog - OpenBSD PF Firewall logs
        pflog-old - OpenBSD PF Firewall logs, pre-3.4
        ppi - Per-Packet Information header
        ppp - PPP
        ppp-with-direction - PPP with Directional Info
        prism - IEEE 802.11 plus Prism II monitor mode header
        raw-icmp-nettl - Raw ICMP with nettl headers
        raw-icmpv6-nettl - Raw ICMPv6 with nettl headers
        raw-telnet-nettl - Raw telnet with nettl headers
        rawip - Raw IP
        rawip-nettl - Raw IP with nettl headers
        rawip4 - Raw IPv4
        rawip6 - Raw IPv6
        redback - Redback SmartEdge
        sccp - SS7 SCCP
        sdlc - SDLC
        sita-wan - SITA WAN packets
        slip - SLIP
        socketcan - SocketCAN
        symantec - Symantec Enterprise Firewall
        tnef - Transport-Neutral Encapsulation Format
        tr - Token Ring
        tr-nettl - Token Ring with nettl headers
        tzsp - Tazmen sniffer protocol
        unknown - Unknown
        unknown-nettl - Unknown link-layer type with nettl headers
        usb - Raw USB packets
        usb-linux - USB packets with Linux header
        usb-linux-mmap - USB packets with Linux header and padding
        user0 - USER 0
        user1 - USER 1
        user10 - USER 10
        user11 - USER 11
        user12 - USER 12
        user13 - USER 13
        user14 - USER 14
        user15 - USER 15
        user2 - USER 2
        user3 - USER 3
        user4 - USER 4
        user5 - USER 5
        user6 - USER 6
        user7 - USER 7
        user8 - USER 8
        user9 - USER 9
        whdlc - Wellfleet HDLC
        wpan - IEEE 802.15.4 Wireless PAN
        wpan-nofcs - IEEE 802.15.4 Wireless PAN with FCS not present
        wpan-nonask-phy - IEEE 802.15.4 Wireless PAN non-ASK PHY
        x25-nettl - X25 with nettl headers
        x2e-serial - X2E serial line capture
        x2e-xoraya - X2E Xoraya

Prev | Up | Next
D.6. rawshark: Dump and analyze network traffic. | Home | D.8. mergecap: Merging multiple capture files into one