This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

editcap doesn’t seem to work in the new version I installed 1.8.7

0

Hi,

I am using the following command to convert from the pcap I've got to MTP2 (E1). It worked fine in previous versions but in 1.8.7 it simply doesn't encapsulate it;

editcap.exe -T mtp2 "file.pcap" "file_converted.pcap"

Thank you, Diana

asked 29 May '13, 06:43

Dianalab9's gravatar image

Dianalab9
26161620
accept rate: 0%

edited 31 May '13, 22:08

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

"Convert" in what sense? Editcap won't transform the contents of packets; all that the -T flag does is let you fix a capture file that has the wrong encapsulation type to have a different encapsulation type, it doesn't actually change the packet headers from the old type to the new type (and never did).

(29 May '13, 12:20) Guy Harris ♦♦

One Answer:

3

The following might work for you:

editcap.exe -T mtp2 -F libpcap "file.pcap" "file_converted.pcap"

See also bug2868.

answered 29 May '13, 11:07

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

It works! thank you very much

(29 May '13, 23:31) Dianalab9