diff options
| author | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2013-09-09 21:32:03 +0000 |
|---|---|---|
| committer | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2013-09-09 21:32:03 +0000 |
| commit | 9d49aa7dd7b3c55773232fcc4183f5e21ce6730f (patch) | |
| tree | 6fcca838fe099a3781261763c97a43821379af4c /doc/editcap.pod | |
| parent | fb6d18fe0d1b512f4451e28b6cdb8594db56ecfb (diff) | |
| download | wireshark-9d49aa7dd7b3c55773232fcc4183f5e21ce6730f.tar.gz | |
Replace the simpler chop example with a more detailed example.
svn path=/trunk/; revision=51901
Diffstat (limited to 'doc/editcap.pod')
| -rw-r--r-- | doc/editcap.pod | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/doc/editcap.pod b/doc/editcap.pod index 8eaa586eb9..d93264409a 100644 --- a/doc/editcap.pod +++ b/doc/editcap.pod @@ -359,10 +359,23 @@ file, use: editcap -L -C 12:4 capture_vlan.pcap capture_no_vlan.pcap -To remove the IP header as well as the last 4 bytes from all packets within an -Ethernet-encapsulated capture file, use: - - editcap -C 14:20 -C -4 capture.pcap chopped.pcap +To chop both the 10 byte and 20 byte regions from the following 75 byte packet +in a single pass, use any of the 8 possible methods provided below: + + <--------------------------- 75 ----------------------------> + + +---+-------+-----------+---------------+-------------------+ + | 5 | 10 | 15 | 20 | 25 | + +---+-------+-----------+---------------+-------------------+ + + 1) editcap -C 5:10 -C -25:-20 capture.pcap chopped.pcap + 2) editcap -C 5:10 -C 50:-20 capture.pcap chopped.pcap + 3) editcap -C -70:10 -C -25:-20 capture.pcap chopped.pcap + 4) editcap -C -70:10 -C 50:-20 capture.pcap chopped.pcap + 5) editcap -C 30:20 -C -60:-10 capture.pcap chopped.pcap + 6) editcap -C 30:20 -C 15:-10 capture.pcap chopped.pcap + 7) editcap -C -45:20 -C -60:-10 capture.pcap chopped.pcap + 8) editcap -C -45:20 -C 15:-10 capture.pcap chopped.pcap =head1 SEE ALSO |