Ethereal-dev: Re: [Ethereal-dev] Could someone with more knowledge than me update/improve the

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 13 Oct 2005 08:09:02 +0200 (CEST)
On Wed, 12 Oct 2005, Ulf Lamping wrote:

> Jaap Keuter wrote:
>
> >Hi,
> >
> >It is not so much the -r option that is misleading, it's the synopsys
> >which doesn't make clear that the command can work on a range of packets.
> >I can suggest the following change for that:
> >
> >This changes the synopsys into
> >
> >SYNOPSYS
> >       editcap [ -E error probability] [ -F file format ] [ -h ] [ -r ]
> >       [ -s snaplen ] [ -t time adjustment ] [ -T encapsulation type ]
> >       [ -v ] infile outfile [ [-record#] | [record#[-[record#]] ] [...]
> >
> >And even though it is more complicated it covers the ranges question.
> >
> Thanks for trying to fix this.
>
> IMHO Unfortunately, I think it complicates more than it solves.
>
> Why not simply add an (a few) *examples* of the usage.
>
> Regards, ULFL

I can see that problem. It would suggest a mix. An extention to the
synopsys (which I always use to get an overview of the possibilities)
shows that ranges are possible. A set of examples shows use of this (with
the -r option). Please review the examples and offer any suggestions of
better ones.

NAME
       editcap - Edit and/or translate the format of capture files

SYNOPSYS
       editcap [ -E error probability] [ -F file format ] [ -h ] [ -r ]
       [ -s snaplen ] [ -t time adjustment ] [ -T encapsulation type ]
       [ -v ] infile outfile [ record#[-record#] ... ]

.....

EXAMPLES
       To see more detailed description of the options use:

           editcap -h

       To shrink the capture file by truncating the packets at 64 bytes
       and writing it as Sun snoop file use:

           editcap -s 64 -F snoop capture.pcap shortcapture.snoop

       To delete packet 1000 from the capture file use:

           editcap capture.pcap sans1000.pcap 1000

       To crop a capture file to packet 200 to 750 inclusive use:

           editcap -r capture.pcap small.pcap 200-750

       To cut off a capture file at packet 500 use:

           editcap capture.pcap 500.pcap 501-

           or

           editcap -r capture.pcap 500.pcap -500

       To introduce 5% random errors in a capture file use:

           editcap -E 0.05 capture.pcap capture_error.pcap


......