This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Greetings,

Let me explain the context first. I have an application that filters pcap files in bulk. And then I got some pcap files from a third part, and the application just would not work.

After analyzing this pcap file, I found out that there are 4 extra octets in the beginning of every packet in the file (analysis made by extracting the raw data from the pcap file). Due to these bytes, all the information is shifted, so the bytes informing that it is an IP packet are the 16th and 17th instead of the 12th and 13th expected.

However, wireshark can read this file just fine.

So here are the questions:

1) Is it possible to convert this file to remove these extra octets?

2) Why would there be these extra octets?

3) How does wireshark detect it?

asked 06 Dec '13, 04:51

Lacovisk's gravatar image

Lacovisk
11114
accept rate: 0%

edited 07 Dec '13, 14:52

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


  1. Yes, you can use the command line tool "editcap" (comes with Wireshark) using the -C parameter (capital "C", not lower case). Run editcap without parameters to get help.
  2. Not sure, but some devices use additional bytes in the packet to store meta data along with the packet. Some TAP vendors do this, but usually at the end of each frame.
  3. Wireshark probably either has some heuristic to do this, or the file has some indicator that tells Wireshark how to read the frames correctly, e.g. a special Link Layer Type.
permanent link

answered 06 Dec '13, 04:57

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

1

2) Why would there be these extra octets?

That's probably a VLAN tag. You should see the following in the Packet details pane, if it is a VLAN tag.

   Frame
   Ethernet II
   802.1Q Virtual LAN
   Internet Protocol Version 4

3) How does wireshark detect it?

Based on the ethertype: 0x8100 for a VLAN tagged frame. 0x0800 for a 'regular' IP frame.

1) Is it possible to convert this file to remove these extra octets?

If it is a VLAN tag: see the answer of @Jasper or use tcprewrite

tcprewrite --enet-vlan=del --infile=input.pcap --outfile=output.pcap

Regards
Kurt

(06 Dec '13, 05:14) Kurt Knochner ♦

VLAN tag! Of course, silly me!

Thanks very much!

(06 Dec '13, 06:03) Lacovisk
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×248
×1
×1

question asked: 06 Dec '13, 04:51

question was seen: 3,381 times

last updated: 07 Dec '13, 14:52

p​o​w​e​r​e​d by O​S​Q​A