Ethereal-users: Re: [Ethereal-users] How to do the equivalent of 'grep "display filter" *.cap >

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Thu, 11 Aug 2005 18:10:42 -0700 (PDT)
Bill Meier wrote:
> Does this work?  [for each file] "tethereal -r ... -R ... -F ... -w- >>
> foo.pcap"

No.  A libpcap file has a file header, followed by a sequence of packets;
that will put file headers into the middle of the file.

> or must I write a separate output file from tethereal for each input file
> and use mergecap ?

Yes.