Wireshark-users: Re: [Wireshark-users] Convert from NA Sniffer (Windows) 2.00x to libpcap
On Aug 6, 2009, at 6:58 PM, Rayne wrote:
I have some traffic that is of NA Sniffer (Windows) 2.00x type that
I wish to convert to libpcap, so I can run it through TCP replay.
I've been trying to use editcap:
editcap -F libpcap input.cap output.pcap
But I keep getting the error "Can't open or create output.pcap:
Files from that network type can't be saved in that format".
On what type of network device did you capture the traffic?
"Files from that network type can't be saved in that format" means
that the link-layer type is not one that Wireshark can write out in
the file format in which you're trying to write it - and, for libpcap,
that usually means that libpcap simply doesn't support that link-layer
type.
Some Windows Sniffer network types not supported by Wireshark in
libpcap format are:
ATM (Windows Sniffer ATM captures include the trailer for AAL5 PDUs;
there's no libpcap type for that);
802.11 (we currently don't either discard the radio information or
attempt to translate it into any of the forms supported by libpcap);
ISDN (there is no libpcap type compatible with Windows Sniffer ISDN
captures);
X.25 (there is no libpcap type for X.25);
SDLC (there is no libpcap type for SDLC);
Cisco HDLC (we currently don't discard the direction information).
