Wireshark · Ethereal-users: [ethereal-users] editcap conversion problems

[Jacob Langseth <jwl@xxxxxxxxx>]

I'm having difficulty with editcap's encapsulation
layer conversion.  I've experimented a little, but
so far have not been able to convert between ethernet
and fddi.  Has anyone had success with this?

I'm working with version 0.8.4.

What I've tried, briefly:
>>>

 # create test data set
 $ tcpdump -s 256 -w test_dump

 # verify in ethereal
	ethereal test_dump -> good

 # test ether -> fddi conversion
 $ editcap -T fddi test_dump fddi_dump
	ethereal fddi_dump -> void frames

 # revert to ethernet (make sure capture didn't get trashed)
 $ editcap -T ether fddi_dump ether_dump
	ethereal ether_dump -> good

 # try again, but use swapped bits in the MAC
 $ rm -f fddi_dump
 $ editcap -T fddi_swapped test_dump fddi_dump
	ethereal fddi_dump -> void frames

 # verify ethereal using a known good fddi capture (netmon 2.x)
 $ cp /path/to/known/good/fddi.cap .
	ethereal fddi.cap -> good

 # test fddi -> ethernet
 $ editcap -T ether fddi.cap ether.cap
	ethereal ether.cap -> void frames

>>>

Any insight?

Thanks,
  Jacob Langseth