This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Extra octets in packets in a capture file

0

Greetings,

Let me explain the context first. I have an application that filters pcap files in bulk. And then I got some pcap files from a third part, and the application just would not work.

After analyzing this pcap file, I found out that there are 4 extra octets in the beginning of every packet in the file (analysis made by extracting the raw data from the pcap file). Due to these bytes, all the information is shifted, so the bytes informing that it is an IP packet are the 16th and 17th instead of the 12th and 13th expected.

However, wireshark can read this file just fine.

So here are the questions:

1) Is it possible to convert this file to remove these extra octets?

2) Why would there be these extra octets?

3) How does wireshark detect it?

asked 06 Dec '13, 04:51

Lacovisk's gravatar image

Lacovisk
11●1●1●4
accept rate: 0%

edited 07 Dec '13, 14:52

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k●3●35●196

One Answer:

1
  1. Yes, you can use the command line tool "editcap" (comes with Wireshark) using the -C parameter (capital "C", not lower case). Run editcap without parameters to get help.
  2. Not sure, but some devices use additional bytes in the packet to store meta data along with the packet. Some TAP vendors do this, but usually at the end of each frame.
  3. Wireshark probably either has some heuristic to do this, or the file has some indicator that tells Wireshark how to read the frames correctly, e.g. a special Link Layer Type.

answered 06 Dec '13, 04:57

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

1

2) Why would there be these extra octets?

That's probably a VLAN tag. You should see the following in the Packet details pane, if it is a VLAN tag.

   Frame
   Ethernet II
   802.1Q Virtual LAN
   Internet Protocol Version 4

3) How does wireshark detect it?

Based on the ethertype: 0x8100 for a VLAN tagged frame. 0x0800 for a 'regular' IP frame.

1) Is it possible to convert this file to remove these extra octets?

If it is a VLAN tag: see the answer of @Jasper or use tcprewrite

tcprewrite --enet-vlan=del --infile=input.pcap --outfile=output.pcap

Regards
Kurt

(06 Dec '13, 05:14) Kurt Knochner ♦

VLAN tag! Of course, silly me!

Thanks very much!

(06 Dec '13, 06:03) Lacovisk