Included with Wireshark is a small utility called editcap, which is a command-line utility for working with capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as to print information about capture files.
Example D.3. Help information available from editcap
$ editcap -h Editcap 0.99.6 Edit and/or translate the format of capture files. See http://www.wireshark.org for more information. Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ] A single packet or a range of packets can be selected. Packets: -C <choplen> chop each packet at the end by <choplen> bytes -d remove duplicate packets -E <error probability> set the probability (between 0.0 and 1.0 incl.) that a particular packet byte will be randomly changed -r keep the selected packets, default is to delete them -s <snaplen> truncate packets to max. <snaplen> bytes of data -t <time adjustment> adjust the timestamp of selected packets, <time adjustment> is in relative seconds (e.g. -0.5) -A <start time> don't output packets whose timestamp is before the given time (format as YYYY-MM-DD hh:mm:ss) -B <stop time> don't output packets whose timestamp is after the given time (format as YYYY-MM-DD hh:mm:ss) Output File(s): -c <packets per file> split the packet output to different files, with a maximum of <packets per file> each -F <capture type> set the output file type, default is libpcap an empty "-F" option will list the file types -T <encap type> set the output file encapsulation type, default is the same as the input file an empty "-T" option will list the encapsulation types Miscellaneous: -h display this help and exit -v verbose output $ editcap -F editcap: option requires an argument -- F editcap: The available capture file types for "F": libpcap - Wireshark/tcpdump/... - libpcap nseclibpcap - Wireshark - nanosecond libpcap modlibpcap - Modified tcpdump - libpcap nokialibpcap - Nokia tcpdump - libpcap rh6_1libpcap - Red Hat 6.1 tcpdump - libpcap suse6_3libpcap - SuSE 6.3 tcpdump - libpcap 5views - Accellent 5Views capture dct2000 - Catapult DCT2000 trace (.out format) nettl - HP-UX nettl trace netmon1 - Microsoft NetMon 1.x netmon2 - Microsoft NetMon 2.x ngsniffer - NA Sniffer (DOS) ngwsniffer_1_1 - NA Sniffer (Windows) 1.1 ngwsniffer_2_0 - NA Sniffer (Windows) 2.00x niobserverv9 - Network Instruments Observer (V9) lanalyzer - Novell LANalyzer snoop - Sun snoop rf5 - Tektronix K12xx 32-bit .rf5 format visual - Visual Networks traffic capture $ editcap -T editcap: option requires an argument -- T editcap: The available encapsulation types for "T": ether - Ethernet tr - Token Ring slip - SLIP ppp - PPP fddi - FDDI fddi-swapped - FDDI with bit-swapped MAC addresses rawip - Raw IP arcnet - ARCNET arcnet_linux - Linux ARCNET atm-rfc1483 - RFC 1483 ATM linux-atm-clip - Linux ATM CLIP lapb - LAPB atm-pdus - ATM PDUs atm-pdus-untruncated - ATM PDUs - untruncated null - NULL ascend - Lucent/Ascend access equipment isdn - ISDN ip-over-fc - RFC 2625 IP-over-Fibre Channel ppp-with-direction - PPP with Directional Info ieee-802-11 - IEEE 802.11 Wireless LAN prism - IEEE 802.11 plus Prism II monitor mode header ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information ieee-802-11-radiotap - IEEE 802.11 plus radiotap WLAN header ieee-802-11-avs - IEEE 802.11 plus AVS WLAN header linux-sll - Linux cooked-mode capture frelay - Frame Relay frelay-with-direction - Frame Relay with Directional Info chdlc - Cisco HDLC ios - Cisco IOS internal ltalk - Localtalk pflog-old - OpenBSD PF Firewall logs, pre-3.4 hhdlc - HiPath HDLC docsis - Data Over Cable Service Interface Specification cosine - CoSine L2 debug log whdlc - Wellfleet HDLC sdlc - SDLC tzsp - Tazmen sniffer protocol enc - OpenBSD enc(4) encapsulating interface pflog - OpenBSD PF Firewall logs chdlc-with-direction - Cisco HDLC with Directional Info bluetooth-h4 - Bluetooth H4 mtp2 - SS7 MTP2 mtp3 - SS7 MTP3 irda - IrDA user0 - USER 0 user1 - USER 1 user2 - USER 2 user3 - USER 3 user4 - USER 4 user5 - USER 5 user6 - USER 6 user7 - USER 7 user8 - USER 8 user9 - USER 9 user10 - USER 10 user11 - USER 11 user12 - USER 12 user13 - USER 13 user14 - USER 14 user15 - USER 15 symantec - Symantec Enterprise Firewall ap1394 - Apple IP-over-IEEE 1394 bacnet-ms-tp - BACnet MS/TP raw-icmp-nettl - Raw ICMP with nettl headers raw-icmpv6-nettl - Raw ICMPv6 with nettl headers gprs-llc - GPRS LLC juniper-atm1 - Juniper ATM1 juniper-atm2 - Juniper ATM2 redback - Redback SmartEdge rawip-nettl - Raw IP with nettl headers ether-nettl - Ethernet with nettl headers tr-nettl - Token Ring with nettl headers fddi-nettl - FDDI with nettl headers unknown-nettl - Unknown link-layer type with nettl headers mtp2-with-phdr - MTP2 with pseudoheader juniper-pppoe - Juniper PPPoE gcom-tie1 - GCOM TIE1 gcom-serial - GCOM Serial x25-nettl - X25 with nettl headers k12 - K12 protocol analyzer juniper-mlppp - Juniper MLPPP juniper-mlfr - Juniper MLFR juniper-ether - Juniper Ethernet juniper-ppp - Juniper PPP juniper-frelay - Juniper Frame-Relay juniper-chdlc - Juniper C-HDLC juniper-ggsn - Juniper GGSN lapd - LAPD dct2000 - Catapult DCT2000 ber - ASN.1 Basic Encoding Rules
Where each option has the following meaning:
This option specifies that the frames listed should be kept, not deleted. The default is to delete the listed frames.
This option provides help.
This option specifies verbose operation. The default is silent operation.
This option specifies the frame encapsulation type to use.
It is mainly for converting funny captures to something that Wireshark can deal with.
The default frame encapsulation type is the same as the input encapsulation.
This option specifies the capture file format to write the output file in.
The default is libpcap format.
Specifies that packets should be truncated to {snaplen} bytes of data.
Specifies the time adjustment to be applied to selected packets.
This parameter specifies the input file to use. It must be present.
This parameter specifies the output file to use. It must be present.
This optional parameter specifies the records to include or exclude (depending on the -r option. You can specify individual records or a range of records.