https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4636
Jim Young <jyoung@xxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jyoung@xxxxxxx
--- Comment #2 from Jim Young <jyoung@xxxxxxx> 2010-04-01 03:03:36 PDT ---
Hello admail2,
When using editcap's -F <capture type> to translate from pcapng to some other
capture file format it appears that you can add the -T <encap type>
parameter.
Example (without specifying a "-T <encap type>" option):
> D:\test>editcap -F libpcap test.pcapng test.pcap
> editcap: Can't open or create test.pcap: Files from that network type can't be saved in that format
>
> D:\test>
Example (with "-T ether" option):
> D:\test>editcap -F libpcap test.pcapng test.pcap -T ether
>
> D:\test>dir
> Volume in drive D has no label.
> Volume Serial Number is F443-425C
>
> Directory of D:\test
>
> 04/01/2010 05:54 AM <DIR> .
> 04/01/2010 05:54 AM <DIR> ..
> 04/01/2010 05:49 AM 1,251,779 test.pcap
> 04/01/2010 05:35 AM 1,348,976 test.pcapng
> 2 File(s) 2,600,755 bytes
> 2 Dir(s) 736,821,248 bytes free
>
> D:\test>
I suspect if you choose an appropriate -T <encap type> you will might be able
to
split your larger pcapng file into a set of smaller libpcap files.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.