Wireshark · Ethereal-users: Re: [Ethereal-users] Can't save 'Selected Packets' to 'EtherPeek/AiroPeek trace (V9 file format)'

["Martin Regner" <martin.regner@xxxxxxxxx>]

Guy Harris wrote:
> Nobody's written any code to write the {Ether,Airo}Peek V9 format.

I'm quite sure that the newest versions of Etherpeek/Airopeek also support to
 read files in the "classic" Etherpeek/Airopeek format, and maybe also support to read files in other formats.

The Syngress book about Ethereal mentions that they have suceeded to transfer ethernet
captures from Ethereal to Etherpeek in the following formats:
-Novell LANalyzer    -  name the file with a ".tr1" extension
-Network Associates Sniffer (DOS)    -  name the file with a ".enc" extension
-Network Associates Sniffer (Windows-based) 1.1   -  name the file with a ".cap" extension
-Network Associates Sniffer (Windows-based) 2.00x   -  name the file with a ".cap" extension

There may however be some limitations when using the different formats (e.g. some information lost).
It may work for Ethernet captures - but maybe not for other link layers.

The newest versions of Etherpeek/Airopeek should be able to write files in the old Airopeek/Etherpeek format, but you
must
specify that you want the "classic" file format.

It is probably also possible to save ethernet captures in Network Associates Sniffer (DOS) format.