This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to convert k12(txt) file to pcap from the command line

0

Hello,

I want to convert a .pcap file to k12 file and then do the reverse (i.e. k12 -> pcap), and to do so from the command line. I was able to do so when I was using version 1.0.5, but I can't do it in the newer versions.

Thanks.

This question is marked "community wiki".

asked 07 Mar '11, 07:21

liron's gravatar image

liron
1●1●1●1
accept rate: 0%

anyone? please.

(10 Mar '11, 08:30) liron

Just for my curiosity:

How does converting .pcap to .k12 & back help you ?

(10 Mar '11, 08:57) Bill Meier ♦♦

One Answer:

1

I think the following might work:

  1. To convert .pcap to .k12: editcap -F k12text abc_a.pcap abc.k12

  2. To convert .k12 to .pcap: editcap -T ether abc.k12 abc_b.pcap

    Note: This works properly only if all the frames in the .k12 file have ethernet encapsulation type (which they will if the file was originally converted from a .pcap file with ethernet encapsulation type).

answered 10 Mar '11, 08:54

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

edited 10 Mar '11, 09:00

[After trying the above: The date on each packet is incorrect (maybe because .k12 format doesn't have a date ?) after the .pcap --> .k12 --> .pcap but all the rest of the info is OK].

(10 Mar '11, 09:26) Bill Meier ♦♦

Thanks a lot!

I have an application that simulate traffic using a single pcap file, now instead of recording and generating the needed pcap each time, I use a few previously recorded pcaps as building blocks. In order to build 1 pcap from those building blocks, I'm converting the pcaps into into k12 files, edit (e.g. choosing the needed packets, changing the headers etc.) them as needed and then convert them back into a single pcap file.

Thanks again!

(14 Mar '11, 02:07) liron