Wireshark-users: Re: [Wireshark-users] Packet Slicing
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 15 Oct 2009 18:00:57 -0700

On Oct 15, 2009, at 10:57 AM, j.snelders wrote:


Use the option -s
$ editcap -s 8 test.pcap truncate.pcap
Nope, "-s" in editcap is like "-s" in tcpdump and dumpcap and TShark and Wireshark; it specifies the maximum number of bytes in a packet, and anything past that is cut off, so "-s 8" cuts off everything *except* for the first 8 bytes of a packet.
We have no tool to cut off the first 8 bytes of a packet. What is it that the original poster really needs here?