Ethereal-users: Re: [Ethereal-users] Hacking out data

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Mon, 2 Aug 2004 19:55:49 -0700 (PDT)
Steve Abrahall said:
> My question is
> What would I do to to strip out just the icmp packets from my 180 MB
> file?

    tethereal -r 180_mb_capture_file -R icmp

or just

    tethereal -r 180_mb_capture_file icmp

> Have been trying things like
>
> tethereal-r 180_mb_capture_file -f icmp

"-f" specifies a capture filter; those aren't supported when reading a
capture file (not all link-layer types we support when reading from
capture files are supported by libpcap's filtering engine, which is what's
used for capture filters).  You have to use a read filter when reading a
capture file.