mergecap won't write pcap

retag add tags

I have a hex dump of packets captured on various link types. I use a perl script to split these dumps by link type and then feed each type through text2pcap before running them through mergecap. With text2pcap, I use link types 1, 140, and 141.

text2pcap is churning out pcap files and mergecap creates a pcapng. I need this final merged file to be pcap in order to use it with a playback tool.

When I use the -F pcap option with mergecap it reports "mergecap: The capture file being read can't be written as a "pcap" file."

Any ideas why? Is it due to combining different link types?

Have you checked the mergecap man page ?

The output file frame encapsulation type is set to the type of the input files if all input files have the same type. If not all of the input files have the same frame encapsulation type, the output file type is set to WTAP_ENCAP_PER_PACKET. Note that some capture file formats, most notably pcap, do not currently support WTAP_ENCAP_PER_PACKET. This combination will cause the output file creation to fail.

Chuckc

answered 2020-10-03 02:20:15 +0000, updated 2020-10-03 02:20:32 +0000

edit flag offensive 0 remove flag delete link

Comments

I.e., if you're merging multiple pcap files with different link types, you cannot write that out as a pcap file, only as a pcapng file. pcap supports only one link type per file.

Guy Harris (2020-10-03 02:58:56 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

mergecap won't write pcap edit

Comments

1 Answer

Comments