This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

editcap -A -B options not working

0

Hi, I'm using editcap.exe command from Windows 7 console and not getting desired output. The exact command is:

C:\"C:\Program Files\Wireshark\editcap.exe" -v -A "2016-04-13 14:09:00" -B "2016-04-13 14:18:00" 160413csi05.snoop 160413csi05_narrowtime.snoop
File 160413csi05.snoop is a Sun snoop capture file.

The 160413csi05_narrowtime.snoop is created with file size of 1K. The file opens in Wireshark GUI but there is nothing in file.

The original 160413csi05.snoop file date range is 2016-04-13 12:23:04 for frame 1 to 2016-04-13 14:43:42 for frame 92163.

Thanks

asked 13 Apr '16, 08:33

major's gravatar image

major
11●2●2●4
accept rate: 0%

edited 13 Apr '16, 08:40

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

editcap version (-V)?

(13 Apr '16, 08:42) grahamb ♦

C:>"C:\Program Files\Wireshark\editcap.exe" -version C:\Program Files\Wireshark\editcap.exe: invalid option -- 'e' Editcap 1.12.4 (v1.12.4-0-gb4861da from master-1.12) Edit and/or translate the format of capture files. See http://www.wireshark.org for more information.

(13 Apr '16, 09:03) major

@grahamb It's a lower-case 'v', not an uppercase 'v', so it's the verbose option.

(13 Apr '16, 11:39) cmaynard ♦♦

@cmaynard

The uppercase -V was to get the version info.

(13 Apr '16, 13:57) grahamb ♦

One Answer:

0

@major, It works for me with editcap from 1.12.10, so I don't know why it doesn't work for you; however, if you want the output file to be a snoop file, you need to specify -F snoop.

One thought as to why it might not be working would be if the capture was taken in a different time zone than where you are, but you ought to be able to verify the timestamps by running capinfos 160413csi05_narrowtime.snoop and looking at the Start and End times.

(Moved from comment to answer since this was the solution.)

answered 14 Apr '16, 11:48

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

cmaynard's suggestion to check time zones using capinfo worked. The snoop was originally captured on a Solaris 10 system that uses UTC. My local laptop uses Central time. The below command worked:

C:\>"C:\Program Files\Wireshark\editcap.exe" -v -F snoop -A "2016-04-13 09:09:00" -B "2016-04-13 09:18:00" 160413csi05.snoop 160413csi05_narrowtime.snoop

Thanks for all the assistance!

(14 Apr '16, 07:28) major