Wireshark-users: [Wireshark-users] Editcap 1.2.15 not working
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Rayne <hjazz6@xxxxxxxxx>
Date: Thu, 30 May 2013 03:09:32 -0700 (PDT)
Hi all,

I have the following command to extract packets 1 to 5 from a pcap file using editcap.

    editcap -r test.pcap output.pcap 1 2 3 4 5

This worked on editcap 1.1.1, but with version 1.2.15, the output.pcap is always empty, i.e. only 24 bytes. What could be wrong with it?

BTW, I know I could have used 1-5 instead, but I was just doing a quick test because later I will have to use this syntax.

Thank you.

Regards,
Rayne