Wireshark-dev: Re: [Wireshark-dev] wiretap - using as a library rather than coupled with Wiresh
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 27 Nov 2015 09:53:30 -0800
On Nov 27, 2015, at 7:09 AM, Tim Furlong <dev.null.2007@xxxxxxxxx> wrote:

> Sorry if I'm just missing something, but would editcap itself do the job?  
> 
> editcap <in.pkt> <out.pcapng>
> 
> should read your Wildpackets file and produce a pcapng file; add a "-F pcap" for pcap format instead.

...as long as it's not an AiroPeek capture or an OmniPeek Wi-Fi capture, as *that* would require translating the radio metadata headers from either of the *Peek formats to a format supported in pcap/pcapng files, such as radiotap.  editcap doesn't look at the packet contents, and can't do that translation.