On Thu, Jun 12, 2003 at 10:50:07PM +0200, Joerg Mayer wrote:
> On Thu, Jun 12, 2003 at 11:37:06AM -0400, Joshua Wright wrote:
> > I have a packet capture I created with the WildPackets AiroPeek NX tool.
> > It opens fine in Ethereal, and all the information decodes properly.
> > Is there a way to convert this file to libpcap format? I tried to save
> > it as a different file format, but was unsuccessful.
>
> You should be able to load the capture file and then save it in any format
> that ethereal can write to - and libpcap is definitely one of those formats.
That works only if the particular link-layer format of the input file
(Wiretap encapsulation type) is supported by the output file.
Unfortunately, with AiroPeek we use the
WTAP_ENCAP_IEEE_802_11_WITH_RADIO Wiretap encapsulation type, to supply
the radio information to Ethereal, and there's currently no support for
that encapsulation type in Ethereal for libpcap files.
It might be possible to use the new "802.11 with Prism stuff" format for
that in libpcap; it would probably also be possible to have libpcap just
ignore the radio stuff (although that does mean that if you save the
file in that format in Ethereal, it'll then read the file back, which
means it'll no longer be displaying the radio information).
> Alternatively: Use editcap, which also comes with the Ethereal package. It
> is a command line tool, that allows you to convert between the different
> formats Ethereal understands.
...although editcap can't do any file-format translation that Ethereal
can't do, of course.