Wireshark-bugs: [Wireshark-bugs] [Bug 2868] EditCap and TShark cannot convert some file formats
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868
--- Comment #5 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2012-09-30 20:36:00 PDT ---
(In reply to comment #4)
> EditCap as well as TShark is not able to convert IPTrace to a libpcap format.
> Suprisingly Wireshark is able to do it (when you use "File -> Save as"). Please
> try converting attached trace with following commands:
>
> c:\>"c:\Program Files\Wireshark\editcap.exe" -F nseclibpcap aix61-ping.iptrace
> ping.pcap
> editcap: Can't open or create ping.pcap: Files from that network type can't be
> saved in that format
>
> c:\>"c:\Program Files\Wireshark\tshark.exe" -F libpcap -r aix61-ping.iptrace -w
> test.pcap
> tshark: The capture file being read can't be written in that format.
The following works:
editcap.exe -T ether -F nseclibpcap aix61-ping.iptrace ping.pcap
After I ran that, then I also performed File -> Save As -> File name:
ping2.pcap, Save as type: Wireshark - nanosecond libpcap ping2.pcap from
Wireshark. Running 'diff' indicated that the 2 files, ping.pcap generated from
the editcap command above, and ping2.pcap, generated from Wireshark, were
identical.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.
