|
C:\Program Files\Ethereal>editcap -h
Usage: editcap [-r] [-h] [-v] [-T <encap type>] [-F <capture
type>]
[-s <snaplen>] [-t <time adjustment
<infile> <outfile> [ <record#>[-<record#>] ...
]
where -r specifies that the records specified should be kept, not deleted,
default is to delete
-v specifies verbose operation, default is silent
-h produces this help listing.
-T <encap type> specifies the encapsulation type to use:
ether - Ethernet
tr - Token Ring
slip - SLIP
ppp - PPP
fddi - FDDI
fddi-swapped - FDDI with bit-swapped MAC addresses
rawip - Raw IP
arcnet - ARCNET
arcnet_linux - Linux ARCNET
atm-rfc1483 - RFC 1483 ATM
linux-atm-clip - Linux ATM CLIP
lapb - LAPB
atm-pdus - ATM PDUs
atm-pdus-untruncated - ATM PDUs - untruncated
null - NULL
ascend - Lucent/Ascend access equipment
isdn - ISDN
ip-over-fc - RFC 2625 IP-over-Fibre Channel
ppp-with-direction - PPP with Directional Info
ieee-802-11 - IEEE 802.11 Wireless LAN
ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
linux-sll - Linux cooked-mode capture
frelay - Frame Relay
chdlc - Cisco HDLC
ios - Cisco IOS internal
ltalk - Localtalk
prism - IEEE 802.11 plus Prism II monitor mode header
pflog - OpenBSD PF Firewall logs
hhdlc - HiPath HDLC
docsis - Data Over Cable Service Interface Specification
cosine - CoSine L2 debug log
wlan - IEEE 802.11 plus AVS WLAN monitor header
whdlc - Wellfleet HDLC
sdlc - SDLC
tzsp - Tazmen sniffer protocol
default is the same as the input file
-F <capture type> specifies the capture file type to write:
libpcap - libpcap (tcpdump, Ethereal, etc.)
rh6_1libpcap - Red Hat Linux 6.1 libpcap (tcpdump)
suse6_3libpcap - SuSE Linux 6.3 libpcap (tcpdump)
modlibpcap - modified libpcap (tcpdump)
nokialibpcap - Nokia libpcap (tcpdump)
lanalyzer - Novell LANalyzer
ngsniffer - Network Associates Sniffer (DOS-based)
snoop - Sun snoop
netmon1 - Microsoft Network Monitor 1.x
netmon2 - Microsoft Network Monitor 2.x
ngwsniffer_1_1 - Network Associates Sniffer (Windows-based) 1.1
ngwsniffer_2_0 - Network Associates Sniffer (Windows-based) 2.00x
visual - Visual Networks traffic capture
default is libpcap
-s <snaplen> specifies that packets should be truncated to
<snaplen> bytes of data
-t <time adjustment> specifies the time adjustment
to be applied to selected packets
A range of records can be specified as well
|
