diff options
| author | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2013-09-08 20:29:26 +0000 |
|---|---|---|
| committer | Chris Maynard <Christopher.Maynard@GTECH.COM> | 2013-09-08 20:29:26 +0000 |
| commit | 54adc0d2ffe70561ffbe8b38a4bc36e33ef9ae0d (patch) | |
| tree | b070446f39b89c3ee0b3645f8222799560fd08cd /doc | |
| parent | 1b009df7495d3bd20aa09d7691855d927d96a87d (diff) | |
| download | wireshark-54adc0d2ffe70561ffbe8b38a4bc36e33ef9ae0d.tar.gz | |
Allow an optional offset to be specified when chopping bytes from packets.
svn path=/trunk/; revision=51845
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/editcap.pod | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/doc/editcap.pod b/doc/editcap.pod index b89ecb51ca..d5abe28a1f 100644 --- a/doc/editcap.pod +++ b/doc/editcap.pod @@ -9,7 +9,7 @@ B<editcap> S<[ B<-A> E<lt>start timeE<gt> ]> S<[ B<-B> E<lt>stop timeE<gt> ]> S<[ B<-c> E<lt>packets per fileE<gt> ]> -S<[ B<-C> E<lt>choplenE<gt> ]> +S<[ B<-C> [offset:]E<lt>choplenE<gt> ]> S<[ B<-E> E<lt>error probabilityE<gt> ]> S<[ B<-F> E<lt>file formatE<gt> ]> S<[ B<-h> ]> @@ -89,15 +89,20 @@ be created with a suffix -nnnnn, starting with 00000. If the specified number of packets is written to the output file, the next output file is opened. The default is to use a single output file. -=item -C E<lt>choplenE<gt> +=item -C [offset:]E<lt>choplenE<gt> Sets the chop length to use when writing the packet data. Each packet is chopped by <choplen> bytes of data. Positive values chop at the packet beginning while negative values chop at the packet end. -This is useful for chopping headers for decapsulation of an entire capture or -in the rare case that the conversion between two file formats leaves some random -bytes at the end of each packet. +If the optional offset precedes the <choplen>, then the bytes chopped will be +offset from that value. Positve offsets are from the packet beginning, while +negative offsets are from the packet end. + +This is useful for chopping headers for decapsulation of an entire capture, +removing tunneling headers, or in the rare case that the conversion between two +file formats leaves some random bytes at the end of each packet. Another use is +for removing vlan tags. NOTE: This option can be used more than once, effectively allowing you to chop bytes from the beginning of a packet as well as from the end of a packet in a @@ -347,6 +352,10 @@ To introduce 5% random errors in a capture file use: editcap -E 0.05 capture.pcap capture_error.pcap +To remove vlan tags from an Ethernet-encapsulated capture file use: + + editcap -L -C 12:4 capture_vlan.pcap capture_no_vlan.pcap + =head1 SEE ALSO pcap(3), wireshark(1), tshark(1), mergecap(1), dumpcap(1), capinfos(1), |