1EDITCAP(1) The Wireshark Network Analyzer EDITCAP(1)
2
6 editcap - Edit and/or translate the format of capture files
7
9 editcap [ -A <start time> ] [ -B <stop time> ]
10 [ -c <packets per file> ] [ -C <choplen> ] [ -E <error probability> ]
11 [ -F <file format> ] [ -h ] [ -H <input hosts file<gt ]>
12 [ -i <seconds per file> ] [ -r ] [ -s <snaplen> ]
13 [ -S <strict time adjustment> ] [ -t <time adjustment> ]
14 [ -T <encapsulation type> ] [ -v ] [ -W <file format option>] infile
15 outfile [ packet#[-packet#] ... ]
16 editcap -d | -D <dup window> | -w <dup time window> [ -v ] infile
18 outfile
19
21 Editcap is a program that reads some or all of the captured packets
22 from the infile, optionally converts them in various ways and writes
23 the resulting packets to the capture outfile (or outfiles).
24 By default, it reads all packets from the infile and writes them to the
26 outfile in libpcap file format.
27 An optional list of packet numbers can be specified on the command
29 tail; individual packet numbers separated by whitespace and/or ranges
30 of packet numbers can be specified as start-end, referring to all
31 packets from start to end. By default the selected packets with those
32 numbers will not be written to the capture file. If the -r flag is
33 specified, the whole packet selection is reversed; in that case only
34 the selected packets will be written to the capture file.
35 Editcap can also be used to remove duplicate packets. Several
37 different options (-d, -D and -w) are used to control the packet window
38 or relative time window to be used for duplicate comparison.
39 Editcap is able to detect, read and write the same capture files that
41 are supported by Wireshark. The input file doesn't need a specific
42 filename extension; the file format and an optional gzip compression
43 will be automatically detected. Near the beginning of the DESCRIPTION
44 section of wireshark(1) or
45 <http://www.wireshark.org/docs/man-pages/wireshark.html> is a detailed
46 description of the way Wireshark handles this, which is the same way
47 Editcap handles this.
48 Editcap can write the file in several output formats. The -F flag can
50 be used to specify the format in which to write the capture file;
51 editcap -F provides a list of the available output formats.
52
54 -A <start time>
55 Saves only the packets whose timestamp is on or after start time.
56 The time is given in the following format YYYY-MM-DD HH:MM:SS
57 -B <stop time>
59 Saves only the packets whose timestamp is before stop time. The
60 time is given in the following format YYYY-MM-DD HH:MM:SS
61 -c <packets per file>
63 Splits the packet output to different files based on uniform packet
64 counts with a maximum of <packets per file> each. Each output file
65 will be created with a suffix -nnnnn, starting with 00000. If the
66 specified number of packets is written to the output file, the next
67 output file is opened. The default is to use a single output file.
68 -C <choplen>
70 Sets the chop length to use when writing the packet data. Each
71 packet is chopped by a few <choplen> bytes of data. Positive values
72 chop at the packet beginning while negative values chop at the
73 packet end.
74 This is useful for chopping headers for decapsulation of an entire
76 capture or in the rare case that the conversion between two file
77 formats leaves some random bytes at the end of each packet.
78 -d Attempts to remove duplicate packets. The length and MD5 hash of
80 the current packet are compared to the previous four (4) packets.
81 If a match is found, the current packet is skipped. This option is
82 equivalent to using the option -D 5.
83 -D <dup window>
85 Attempts to remove duplicate packets. The length and MD5 hash of
86 the current packet are compared to the previous <dup window> - 1
87 packets. If a match is found, the current packet is skipped.
88 The use of the option -D 0 combined with the -v option is useful in
90 that each packet's Packet number, Len and MD5 Hash will be printed
91 to standard out. This verbose output (specifically the MD5 hash
92 strings) can be useful in scripts to identify duplicate packets
93 across trace files.
94 The <dup window> is specified as an integer value between 0 and
96 1000000 (inclusive).
97 NOTE: Specifying large <dup window> values with large tracefiles
99 can result in very long processing times for editcap.
100 -E <error probability>
102 Sets the probability that bytes in the output file are randomly
103 changed. Editcap uses that probability (between 0.0 and 1.0
104 inclusive) to apply errors to each data byte in the file. For
105 instance, a probability of 0.02 means that each byte has a 2%
106 chance of having an error.
107 This option is meant to be used for fuzz-testing protocol
109 dissectors.
110 -F <file format>
112 Sets the file format of the output capture file. Editcap can write
113 the file in several formats, editcap -F provides a list of the
114 available output formats. The default is the libpcap format.
115 -h Prints the version and options and exits.
117 -H <input "hosts" file>
119 Read a list of address to host name mappings and include the result
120 in the output file. Implies -W n.
121 The input file format is described at
123 <http://en.wikipedia.org/wiki/Hosts_%28file%29>.
124 -i <seconds per file>
126 Splits the packet output to different files based on uniform time
127 intervals using a maximum interval of <seconds per file> each. Each
128 output file will be created with a suffix -nnnnn, starting with
129 00000. If packets for the specified time interval are written to
130 the output file, the next output file is opened. The default is to
131 use a single output file.
132 -r Reverse the packet selection. Causes the packets whose packet
134 numbers are specified on the command line to be written to the
135 output capture file, instead of discarding them.
136 -s <snaplen>
138 Sets the snapshot length to use when writing the data. If the -s
139 flag is used to specify a snapshot length, packets in the input
140 file with more captured data than the specified snapshot length
141 will have only the amount of data specified by the snapshot length
142 written to the output file.
143 This may be useful if the program that is to read the output file
145 cannot handle packets larger than a certain size (for example, the
146 versions of snoop in Solaris 2.5.1 and Solaris 2.6 appear to reject
147 Ethernet packets larger than the standard Ethernet MTU, making them
148 incapable of handling gigabit Ethernet captures if jumbo packets
149 were used).
150 -S <strict time adjustment>
152 Time adjust selected packets to insure strict chronological order.
153 The <strict time adjustment> value represents relative seconds
155 specified as [-]seconds[.fractional seconds].
156 As the capture file is processed each packet's absolute time is
158 possibly adjusted to be equal to or greater than the previous
159 packet's absolute timestamp depending on the <strict time
160 adjustment> value.
161 If <strict time adjustment> value is 0 or greater (e.g. 0.000001)
163 then only packets with a timestamp less than the previous packet
164 will adjusted. The adjusted timestamp value will be set to be
165 equal to the timestamp value of the previous packet plus the value
166 of the <strict time adjustment> value. A <strict time adjustment>
167 value of 0 will adjust the minimum number of timestamp values
168 necessary to insure that the resulting capture file is in strict
169 chronological order.
170 If <strict time adjustment> value is specified as a negative value,
172 then the timestamp values of all packets will be adjusted to be
173 equal to the timestamp value of the previous packet plus the
174 absolute value of the <lt>strict time adjustment<gt> value. A
175 <strict time adjustment> value of -0 will result in all packets
176 having the timestamp value of the first packet.
177 This feature is useful when the trace file has an occasional packet
179 with a negative delta time relative to the previous packet.
180 -t <time adjustment>
182 Sets the time adjustment to use on selected packets. If the -t
183 flag is used to specify a time adjustment, the specified adjustment
184 will be applied to all selected packets in the capture file. The
185 adjustment is specified as [-]seconds[.fractional seconds]. For
186 example, -t 3600 advances the timestamp on selected packets by one
187 hour while -t -0.5 reduces the timestamp on selected packets by
188 one-half second.
189 This feature is useful when synchronizing dumps collected on
191 different machines where the time difference between the two
192 machines is known or can be estimated.
193 -T <encapsulation type>
195 Sets the packet encapsulation type of the output capture file. If
196 the -T flag is used to specify an encapsulation type, the
197 encapsulation type of the output capture file will be forced to the
198 specified type. editcap -T provides a list of the available types.
199 The default type is the one appropriate to the encapsulation type
200 of the input capture file.
201 Note: this merely forces the encapsulation type of the output file
203 to be the specified type; the packet headers of the packets will
204 not be translated from the encapsulation type of the input capture
205 file to the specified encapsulation type (for example, it will not
206 translate an Ethernet capture to an FDDI capture if an Ethernet
207 capture is read and '-T fddi' is specified). If you need to
208 remove/add headers from/to a packet, you will need
209 od(1)/text2pcap(1).
210 -v Causes editcap to print verbose messages while it's working.
212 Use of -v with the de-duplication switches of -d, -D or -w will
214 cause all MD5 hashes to be printed whether the packet is skipped or
215 not.
216 -w <dup time window>
218 Attempts to remove duplicate packets. The current packet's arrival
219 time is compared with up to 1000000 previous packets. If the
220 packet's relative arrival time is less than or equal to the <dup
221 time window> of a previous packet and the packet length and MD5
222 hash of the current packet are the same then the packet to skipped.
223 The duplicate comparison test stops when the current packet's
224 relative arrival time is greater than <dup time window>.
225 The <dup time window> is specified as seconds[.fractional seconds].
227 The [.fractional seconds] component can be specified to nine (9)
229 decimal places (billionths of a second) but most typical trace
230 files have resolution to six (6) decimal places (millionths of a
231 second).
232 NOTE: Specifying large <dup time window> values with large
234 tracefiles can result in very long processing times for editcap.
235 NOTE: The -w option assumes that the packets are in chronological
237 order. If the packets are NOT in chronological order then the -w
238 duplication removal option may not identify some duplicates.
239 -W <file format option>
241 Save extra information in the file if the format supports it. For
242 example,
243 -F pcapng -W n
245 will save host name resolution records along with captured packets.
247 Future versions of Wireshark may automatically change the capture
249 format to pcapng as needed.
250 The argument is a string that may contain the following letter:
252 n write network address resolution information (pcapng only)
254
256 To see more detailed description of the options use:
257 editcap -h
259 To shrink the capture file by truncating the packets at 64 bytes and
261 writing it as Sun snoop file use:
262 editcap -s 64 -F snoop capture.pcap shortcapture.snoop
264 To delete packet 1000 from the capture file use:
266 editcap capture.pcap sans1000.pcap 1000
268 To limit a capture file to packets from number 200 to 750 (inclusive)
270 use:
271 editcap -r capture.pcap small.pcap 200-750
273 To get all packets from number 1-500 (inclusive) use:
275 editcap -r capture.pcap first500.pcap 1-500
277 or
279 editcap capture.pcap first500.pcap 501-9999999
281 To exclude packets 1, 5, 10 to 20 and 30 to 40 from the new file use:
283 editcap capture.pcap exclude.pcap 1 5 10-20 30-40
285 To select just packets 1, 5, 10 to 20 and 30 to 40 for the new file
287 use:
288 editcap -r capture.pcap select.pcap 1 5 10-20 30-40
290 To remove duplicate packets seen within the prior four frames use:
292 editcap -d capture.pcap dedup.pcap
294 To remove duplicate packets seen within the prior 100 frames use:
296 editcap -D 101 capture.pcap dedup.pcap
298 To remove duplicate packets seen equal to or less than 1/10th of a
300 second:
301 editcap -w 0.1 capture.pcap dedup.pcap
303 To display the MD5 hash for all of the packets (and NOT generate any
305 real output file):
306 editcap -v -D 0 capture.pcap /dev/null
308 or on Windows systems
310 editcap -v -D 0 capture.pcap NUL
312 To advance the timestamps of each packet forward by 3.0827 seconds:
314 editcap -t 3.0827 capture.pcap adjusted.pcap
316 To insure all timestamps are in strict chronological order:
318 editcap -S 0 capture.pcap adjusted.pcap
320 To introduce 5% random errors in a capture file use:
322 editcap -E 0.05 capture.pcap capture_error.pcap
324
326 pcap(3), wireshark(1), tshark(1), mergecap(1), dumpcap(1), capinfos(1),
327 text2pcap(1), od(1), pcap-filter(7) or tcpdump(8) if it doesn't exist.
328
330 Editcap is part of the Wireshark distribution. The latest version of
331 Wireshark can be found at <http://www.wireshark.org>.
332 HTML versions of the Wireshark project man pages are available at:
334 <http://www.wireshark.org/docs/man-pages>.
335
337 Original Author
338 -------- ------
339 Richard Sharpe <sharpe[AT]ns.aus.com>
340 Contributors
343 ------------
344 Guy Harris <guy[AT]alum.mit.edu>
345 Ulf Lamping <ulf.lamping[AT]web.de>
3461.8.10 2013-07-23 EDITCAP(1)