Keith French wrote:
> If you want to save the output file in Observer format with -F within
> Mergecap, what is the key word for the Observer 9 format. It is not listed
> in mergecap.html for V0.10.14, or in any of the other help files?
$ mergecap -h
Mergecap 0.10.14 (SVN Rev 17304)
Merge two or more capture files into one.
See http://www.ethereal.com for more information.
Usage: mergecap [options] -w <outfile|-> <infile> ...
Output:
...
-F <capture type> set the output file type, default is libpcap
an empty "-F" option will list the file types
...
Miscellaneous:
-h display this help and exit
-v verbose output
$ mergecap -F
mergecap: option requires an argument -- F
editcap: The available capture file types for "F":
libpcap - libpcap (tcpdump, Ethereal, etc.)
...
niobserverv9 - Network Instruments Observer version 9
....
> Generally can Ethereal only read V9 files from Observer or can it do later
> versions?
It can only read files written with a version number of 09.00. I don't
know whether later versions of the software write a different version
number of not.
