Ethereal-users: Re: [Ethereal-users] Filtering with EDITCAP

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 17 Jan 2006 23:39:30 -0800
Ken Young wrote:

Can some provide me with an example where I can take a saved capture file
and run EDITCAP.EXE against it to strip out (exclude) certain protocols?
No, they can't, because editcap doesn't dissect packets, so it has no idea what protocols are in a packet, and thus cannot exclude certain protocols when processing a capture file.
If you want to strip out certain protocols, you'd do that with tethereal, which *does* dissect packets.
Note, by the way, that a reassembled packet (i.e., one whose data is contained in more than one lower-level packets) will be identified as being a packet with a given protocol only in the last of the lower-level packets, so the other packets wouldn't be stripped out in that case. 


Ie. Remove CDP and STP packets via command line.


	tethereal -r {input file} -w {output file} -R "not cdp and not stp"