Wireshark-bugs: [Wireshark-bugs] [Bug 3961] Can't convert from .pcapng to .pcap with versions 1.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3961
--- Comment #8 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-11-29 07:43:07 PST ---
(In reply to comment #0)
> Error when converting .pcapng to .pcap:
> $ editcap test_130.pcapng test_130pcapng.pcap
> editcap: Can't open or create test_130pcapng.pcap: Files from that network type
> can't be saved in that format
> No problems to convert the files:
> $ editcap test_113.pcapng test_113pcapng.pcap
> $ editcap test_121.pcapng test_121pcapng.pcap
> $ editcap test2_121.pcapng test2_121pcapng.pcap
> $ editcap test_130.pcapng test_130pcapng.pcap
Joke, before I go any further, I wanted to try to clear up something. I had
created a simple pcapng file containing only Ethernet encapsulation, i.e., a
single Interface Desciption Block (IDB) with encap = LINKTYPE_ETHERNET. I was
unable to convert that file to pcap without either specifying "-T ether" or
without the attached patch. But you were apparently successful in converting
some pcapng files to pcap? I'm not sure how that was possible since the
encapsulation would have been set to "unknown". Are you able to post one of
those files? Also, was there anything different about the file that you
weren't able to convert from pcapng to pcap? For instance, did it contain
multiple encapsulations, whereas the others only contained a single
encapsulation? Can you post that capture file as well? If you don't have the
originals, maybe you could recreate some that mimic the same behavior?
Does anyone have a pcapng file available with multiple encapsulations?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
