Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 4636] can not convert pcapng to other types

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4636

Jim Young <jyoung@xxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jyoung@xxxxxxx

--- Comment #2 from Jim Young <jyoung@xxxxxxx> 2010-04-01 03:03:36 PDT ---
Hello admail2,

When using editcap's -F <capture type> to translate from pcapng to some other
capture file format it appears that you can add the -T <encap type>
parameter.   

Example (without specifying a "-T <encap type>" option):

> D:\test>editcap -F libpcap test.pcapng test.pcap
> editcap: Can't open or create test.pcap: Files from that network type can't be saved in that format
> 
> D:\test>

Example (with "-T ether" option):

> D:\test>editcap -F libpcap test.pcapng test.pcap -T ether
> 
> D:\test>dir
>  Volume in drive D has no label.
>  Volume Serial Number is F443-425C
> 
>  Directory of D:\test
> 
> 04/01/2010  05:54 AM    <DIR>          .
> 04/01/2010  05:54 AM    <DIR>          ..
> 04/01/2010  05:49 AM         1,251,779 test.pcap
> 04/01/2010  05:35 AM         1,348,976 test.pcapng
>                2 File(s)      2,600,755 bytes
>                2 Dir(s)     736,821,248 bytes free
> 
> D:\test>

I suspect if you choose an appropriate -T <encap type> you will might be able
to
split your larger pcapng file into a set of smaller libpcap files.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.