Packet numbers can be specified as start- end, referring to all Tail individual packet numbers separated by whitespace and/or ranges of Range from which packets are read from the infile.Īn optional list of packet numbers can be specified on the command The -A and -B option allow you to limit the time Or outfile to read from standard input or write to standard output, Them to the outfile in pcapng file format. Writes the resulting packets to the capture outfile (orīy default, it reads all packets from the infile and writes Packets from the infile, optionally converts them in various ways and infile outfileĮditcap is a program that reads some or all of the captured Note that this change can be reverted, once the package has been installed.Editcap - Edit and/or translate the format of capture files SYNOPSIS app-arch/libarchive-3.3.1 (Change USE: -lz4) (dev-util/cmake-3.9.6:0/0::gentoo, ebuild scheduled for merge) (buildtime) (app-arch/lz4-1.8.0:0/r131::gentoo, ebuild scheduled for merge) (buildtime_slot_op) (app-arch/libarchive-3.3.1:0/13::gentoo, ebuild scheduled for merge) (buildtime_slot_op) (dev-util/cmake-3.9.6:0/0::gentoo, ebuild scheduled for merge) depends on

Total: 5 packages (5 new), Size of downloads: 0 KiB app-arch/libarchive-3.3.1:0/13::gentoo USE='acl bzip2 e2fsprogs iconv lz4 lzma lzo threads xattr zlib -expat -libressl -nettle -static-libs' ABI_X86='(64) -32 (-x32)' 0 KiB net-libs/libssh-0.7.4:0/4::gentoo USE='sftp zlib -debug -doc -examples -gcrypt -gssapi -libressl -pcap -server -ssh1 -static-libs ' 0 KiB

net-analyzer/wireshark-2.4.3-r1:0/2.4.3::gentoo USE='capinfos caps captype dftest dumpcap editcap filecaps geoip libssh lz4 mergecap netlink nghttp2 pcap portaudio randpkt randpktdump reordercap sharkd smi spandsp sshdump ssl text2pcap tfshark tshark udpdump zlib -adns -androiddump -ciscodump -doc -doc-pdf -gtk -kerberos -libxml2 -lua -qt5 -sbc (-selinux) -snappy' CPU_FLAGS_X86='sse4_2' 0 KiB I recently run into this situation on a newish system:

Editcap examples