This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I want to convert a .pcap file to k12 file and then do the reverse (i.e. k12 -> pcap), and to do so from the command line. I was able to do so when I was using version 1.0.5, but I can't do it in the newer versions.

Thanks.

This question is marked "community wiki".

asked 07 Mar '11, 07:21

liron's gravatar image

liron
1111
accept rate: 0%

anyone? please.

(10 Mar '11, 08:30) liron

Just for my curiosity:

How does converting .pcap to .k12 & back help you ?

(10 Mar '11, 08:57) Bill Meier ♦♦

I think the following might work:

  1. To convert .pcap to .k12: editcap -F k12text abc_a.pcap abc.k12
  2. To convert .k12 to .pcap: editcap -T ether abc.k12 abc_b.pcap

    Note: This works properly only if all the frames in the .k12 file have ethernet encapsulation type (which they will if the file was originally converted from a .pcap file with ethernet encapsulation type).

permanent link

answered 10 Mar '11, 08:54

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

edited 10 Mar '11, 09:00

[After trying the above: The date on each packet is incorrect (maybe because .k12 format doesn't have a date ?) after the .pcap --> .k12 --> .pcap but all the rest of the info is OK].

(10 Mar '11, 09:26) Bill Meier ♦♦

Thanks a lot!

I have an application that simulate traffic using a single pcap file, now instead of recording and generating the needed pcap each time, I use a few previously recorded pcaps as building blocks. In order to build 1 pcap from those building blocks, I'm converting the pcaps into into k12 files, edit (e.g. choosing the needed packets, changing the headers etc.) them as needed and then convert them back into a single pcap file.

Thanks again!

(14 Mar '11, 02:07) liron
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×16

question asked: 07 Mar '11, 07:21

question was seen: 6,563 times

last updated: 14 Mar '11, 02:07

p​o​w​e​r​e​d by O​S​Q​A