On 6/14/2011 7:05 AM, Andrej van der Zee wrote:
Hi,
I have a question about the nettl HP-UX capture format. I am able to
view this in Wireshark. Is there also a way to convert a nettl-file to
a pcap-file on the command line (linux) without loading them into
Wireshark? I tried editcap, but I get the following error:
editcap /tmp/test.nettl -F libpcap /tmp/test.pcap
editcap: Can't open or create /tmp/test.pcap: Files from that network
type can't be saved in that format
The short answer: wireshark, tshark and editcap do not have the
capability to save nettl files in pcap format (or any format other than
nettl).
(If you try File ! Save As in Wireshark you will see that the only
choice for "Save As Type" is "HP-UX nettl trace").
I'm not familiar with the nettl format so I don't know the reason why
there's no capability to save in another format.
Possibly some required information is not available or the work was just
never done or ...
Does the program you are using to create the nettl format files have the
capability to save in pcap format ?
