Re: how do I extract these packets with editcap?

[Martin Visser <martinvisser99 () gmail com>]

Marilo,

I just did some testing, and it confirmed my thoughts from the editcap man
page. The -A and -B switches are only good to the nearest second.

So, 'editcap  -A "2012-04-07 22:11:14" -B "2012-04-07 22:11:14" /tmp/f.pcap
 /tmp/o.pcap' has the same effect as

'editcap  -A "2012-04-07 22:11:14.11" -B "2012-04-07 22:11:14.12"
/tmp/f.pcap  /tmp/o.pcap' Both edit out 1 second of packets.

If you need  a more precise edit, use the packet numbers, something like -
'editcap   /tmp/f.pcap  /tmp/o.pcap 11-12'



Regards, Martin

MartinVisser99 () gmail com


On 6 April 2012 08:21, Marilo <narium85-mlscar () yahoo co uk> wrote:

> Here is a sample from my file
>
> I want to extract a specific packet or range of packets, based on time.
>
>
>
> C:\sdf>tshark -t ad -r ga.pcap | head -n 6
> 2161 2012-04-02 08:49:22.022227 192.168.1.66 -> 192.168.1.65 TCP
> 1085 2012-04-02 08:49:22.022329 192.168.1.65 -> 192.168.1.66 TCP
> 2161 2012-04-02 08:49:22.022481 192.168.1.66 -> 192.168.1.65 TCP
> 2162 2012-04-02 08:49:22.023061 192.168.1.66 -> 192.168.1.65 TCP
> 1085 2012-04-02 08:49:22.023103 192.168.1.65 -> 192.168.1.66 TCP
> 2162 2012-04-02 08:49:22.023236 192.168.1.66 -> 192.168.1.65 TCP
>
> C:\sdf>tshark -r ga.pcap | head -n 6
> 2161   0.000000 192.168.1.66 -> 192.168.1.65 TCP 66 1085 2161
> 1085   0.000102 192.168.1.65 -> 192.168.1.66 TCP 66 2161 1085
> 2161   0.000254 192.168.1.66 -> 192.168.1.65 TCP 60 1085 2161
> 2162   0.000834 192.168.1.66 -> 192.168.1.65 TCP 66 1085 2162
> 1085   0.000876 192.168.1.65 -> 192.168.1.66 TCP 66 2162 1085
> 2162   0.001009 192.168.1.66 -> 192.168.1.65 TCP 60 1085 2162
>
> I'd like to use the -r format since it's more abbreviated, but anyhow,
> trying with the longer format
> I tried this line
> C:\sdf>editcap -r -A "2012-04-02 08:49:22.022227"  ga.pcap gaa.pcap
>
> and I found that it created a new file gaa.pcap but exactly the same size
> as ga.pcap  as if I hadn't done the -A switch.
>
> If I can get -A and -B to work then I suppose I could extract ranges of
> packets, or specific ones, but I can't get -A to work there when I tried it.
>
> I'd also like to know if there is any other unique identifier with the
> packet maybe an absolute sequence number, and how to extract it based on
> that..
>
> Though I can't even get the time one to work at the moment.
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe