Hi, I am trying to convert/ encapsulation from Linux cooked capture to Ethernet packet; I am trying to use editcap and text2pcap - but don't get the desired result. can anyone advice? Thanks in advanced, Diana asked 29 May '13, 07:08 Dianalab9 |
2 Answers:
Editcap, alone, won't help here. As I stated in a comment on your other related question, editcap does NOT transform the contents of packets; it will not, for example, take packets with Linux cooked capture headers, remove the cooked capture headers, construct Ethernet headers by:
and then prepend the resulting header. text2pcap might help here, but it's not sufficient. You could take the packets, print their time stamps and raw hex data, write a program (in whatever language) to do the transformation described above and write the resulting file out, and then turn it into a pcap file using text2pcap. The "write a program" step is the key one; I'm not sure there are any existing programs that will take a Linux cooked capture and generate an Ethernet capture. answered 29 May '13, 12:30 Guy Harris ♦♦ |
You need to overwride the output format to Ethernet II, and supply the source MAC and dest MAC which the Cooked Capture format mangles. For example:
References: answered 24 Aug '15, 19:29 superjamie |
Great! I exported it to Hex, deleted first 16 bytes and ran: text2pcap.exe -e 0x800 Text.txt ConvertedoEthernet.pcap works beautifully :)
Thanks!
"I exported it to Hex, deleted first 16 bytes and ran: text2pcap.exe -e 0x800 Text.txt ConvertedoEthernet.pcap"
I am new in this field and trying to convert from Linux cooked capture to Ethernet packet.
Would you please elaborate how did you do it?
Thanks in advance.
Just FYI: TraceWrangler latest version can now do the replacement of Linux cooked headers to Ethernet headers. It will automatically set the link layer type of the Interface Description Block to Ethernet and copy/set the MAC address to the fitting source or destination address in each frame if applicable. Packets to broadcast will get a broadcast MAC as destination address.