Ethereal-users: Re: [ethereal-users] libpcap to snoop conversion

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Thu, 13 Jan 2000 09:31:29 -0800
> Please forgive me if this is the wrong place to ask. But can ethereal 
> export capture files in other capture formats. Or is there any utility 
> tha will convert capture files between libpcap and other (snoop) formats.

In the latest release of Ethereal, the answer to both questions is
"yes".

Either in the 0.8.0 or 0.8.1 release (I forget where I added it), the
dialog box popped up by the "Save As" option of the "File" menu includes
an item to allow you to select the format in which the file is to be
written; snoop format is one of the formats supported.

In addition, there is an "editcap" utility in that release as well -
it's not currently built by default, and it has no man page, but both of
those will be fixed in the next release - that can read a capture file
and write another capture file, possibly in a different file format, and
it can optionally select certain packets not to write to the output
capture file, or select certain packets as the only ones to write to the
output capture file.