Wireshark · Ethereal-users: [Ethereal-users] Re: can convert NAI Sniffer files to tcpdump format

[Guy Harris <guy@xxxxxxxxxxxx>]

Note that

	1) I'm on the ethereal-users and ethereal-dev lists, so you
	   don't need to send mail to those lists *and* to me
	   explicitly;

	2) questions about Ethereal should be sent to the list in
	   general - I'm just one member, and shouldn't be singled out.

On Tue, Nov 25, 2003 at 04:47:48PM +0000, gab.seun jones.ewulomi wrote:
> Can someone point me to any tools that can convert NAI Sniffer files to 
> tcpdump(libcap) format

Yes, there's a tool called "Ethereal" that might be able to do it. :-) 

I.e., read in the Sniffer file and save it in libpcap format.  If it's
possible to save the file in libpcap format (it's not necessarily
possible - there is, for example, no support for ISDN captures with both
D and B channels in libpcap format), and if Ethereal can read the
capture, that'll convert it.

There's also an "editcap" utility that comes with Ethereal that you can
use to do that conversion from the command line.

If Ethereal can't do it (editcap, Ethereal, and Tethereal use the same
routines to read and write captures, so they should all have the same
capabilities), there's a commercial tool for Windows that can convert
capture files:

	http://www.wildpackets.com/products/proconvert