Hi, I'm working for CISCO, we would like to convert the packet capture made in cisco routers into PCAP format, for that I would like to understand the PCAP format. Please suggest how to convert the raw packet data into pcap format? Thx Amby asked 25 Jan '16, 06:38 Ambalavanan |
3 Answers:
I would strongly recommend to use pcapng, as it
If you insist, the traditional pcap is described here. In both cases, the raw packet data need no conversion, they just need to be augmented with additional information and, in some cases, an appropriate encapsulation header. (edit: updated the link to pcapng description with Jaap's up-to-date one, kept the advice to use pcapng). answered 25 Jan '16, 06:50 sindy edited 25 Jan '16, 07:58 |
If using pcapng please use the current draft. If going 'old school', use this specification. answered 25 Jan '16, 07:52 Jaap ♦ edited 25 Jan '16, 08:07 grahamb ♦ |
Also, I think there's some router company some of whose equipment can export captures in pcap format; you might want to see if you can talk to the people responsible for that. answered 25 Jan '16, 13:27 Guy Harris ♦♦ |