This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I have a TDM interface which can capture LAPD traffic, and I have an Application which can output the captured packets both in pcap or in pcap-ng format and both to file or to output pipe.

I need to capture on both an Ethernet interface and the TDM interface at the same time, and get a single common file containing captured packets from both interfaces.

Issue #1: merge fails
If I create the "ethernet" pcapng using Wireshark and the "LAPD" pcapng using my application, and then try to merge them together, my Wireshark (1.12.7 on 64-bit Windows 7 at the moment) crashes. The mergecap from the same package doesn't crash but fails with a complaint:

D:"c:mergecap.exe" -w merge-attempt.pcapng export-ether.pcapng export-lapd.pcapng -v
mergecap: export-ether.pcapng is type Wireshark/... - pcapng.
mergecap: export-lapd.pcapng is type Wireshark/... - pcapng.
mergecap: multiple frame encapsulation types detected
defaulting to WTAP-ENCAP-PER-PACKET
export-ether.pcapng had type Ethernet (ether)
export-lapd.pcapng had type LAPD (lapd)
mergecap: selected frame-type Per packet (per-packet)
mergecap: Can't open or create merge-attempt.pcapng: Files from that network type can't be saved in that format

Merging two pcapng files with same frame encapsulation types by Wireshark works fine, regardless the particular encapsulation type. As for the LAPD, encapsulations "LAPD" (203) and "LAPD with linux pseudo-header" (177) give same results when merged with "ether" (1).

Issue #2: capture from a pipe doesn't accept pcapng
When I let Wireshark capture simultaneously from the ethernet interface and from the Application's output pipe, I do get my desired common file, but as Wireshark refuses the pcapng, the Application must send pcap over the pipe. This forces me to use "LAPD with linux pseudo-header" encapsulation for the TDM channel, as "LAPD" encapsulation itself does not carry any information about packet direction. The "packet flags" which can be used for this and other purposes (indication of errors during capture) do not fit into pcap.

Questions:
Anyone knows how to make mergecap (or Wireshark itself) do the job?
Anyone knows how to make Wireshark capture pcapng from the pipe?
Or any of these would require a development request?

Edit: the two minimalistic pcapng files illustrating the issue can be found here:
SIP INVITE
Q.931 SETUP

Thank you
Pavel

asked 13 Sep '15, 04:02

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 11 Nov '15, 01:55

OK, I'll answer to myself.

As of now, at least for the stable version, and although some page at Wireshark wiki states otherwise, pcapng is not an acceptable input to the pipe, dot.

And, as of now, the mergecap from the install package is not a suitable tool for the task either.

So the solution is: as you are able to generate pcapng in your application, it should not be a big deal for you to code your own "mergepcapng" application which will read the Ethernet frames from pcapng saved by Wireshark and LAPD frames with packet flags saved by your capturing application, and write them both into a pcapng file which, luckily, Wireshark is able to read. Your advantage over the Wireshark team is that you need not bother about support of all the timestamp resolutions, interface/system name merge/substitution etc. in an ad-hoc code.

(24 Sep '15, 09:16) sindy

Anyone knows how to make mergecap (or Wireshark itself) do the job?

Although mergecap does not work (as you said) the following two methods do work for me with Wireshark 1.12.8 on Windows.

  • Open one pcap file, then use File -> Merge

  • Open Wireshark and drag-drop both files at once into the Wireshark window

The merged file can be saved as pcapng. I used a sample pcapng file with LAPD encapsulation from bugs.wireshark.org

If these methods don't work for you, please post two (small) sample files, so we can check.

Edit: in Wireshark 2.0.0, drag-and-dropping both files opens just one of them, and for some reason, the ethernet encapsulated one is preferred regardless the order of their selection. File->Merge works normally.

Regards
Kurt

permanent link

answered 10 Nov '15, 18:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 05 Dec '15, 09:41

sindy's gravatar image

sindy
6.0k4851

Hi Kurt,

I didn't know drag and drop of two files at once was possible, and it does work with my files in Wireshark 1.12.8/W7-64bit.

Opening of one file followed by File->Merge of the other one does not work with the same two files (my current Wireshark freezes like the 1.12.7 did).

As the drag and drop works, I'll accept your answer. As the "traditional method" works for you but does not work for me (same 1.12.8 but I don't know what is your OS), are you interested in the two files anyway?

Pavel

(10 Nov '15, 22:23) sindy

I've added links to the simplest possible files to my question (one frame per file). I hesitate to file a bug as the importance for the community is low now as you've found the right way to fulfil the task.

(11 Nov '15, 02:08) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×37
×36
×21
×14

question asked: 13 Sep '15, 04:02

question was seen: 1,849 times

last updated: 05 Dec '15, 09:41

p​o​w​e​r​e​d by O​S​Q​A