Wireshark-users: Re: [Wireshark-users] Packet Slicing
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "j.snelders" <j.snelders@xxxxxxxxxx>
Date: Thu, 15 Oct 2009 19:57:25 +0200
Hi Darrell,

Use the option -s
$ editcap -s 8 test.pcap truncate.pcap

HTH
Joan

On Thu, 15 Oct 2009 13:22:31 -0400 Darrell Arthur wrote:

>I want to strip the header information from a packet capture.  I've tried
>using editcap -C .. but that just strips a certain amount of bytes from
the
>end of each packet.  What can I use to strip the, say, first 8 bytes of
a
>packet??