Re: Packet Slicing

[Guy Harris <guy () alum mit edu>]

On Oct 15, 2009, at 10:57 AM, j.snelders wrote:

> Use the option -s
> $ editcap -s 8 test.pcap truncate.pcap

Nope, "-s" in editcap is like "-s" in tcpdump and dumpcap and TShark  
and Wireshark; it specifies the maximum number of bytes in a packet,  
and anything past that is cut off, so "-s 8"  cuts off everything  
*except* for the first 8 bytes of a packet.

We have no tool to cut off the first 8 bytes of a packet.  What is it  
that the original poster really needs here?
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe