Re: [Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Martin Mathieson
On Tue, Apr 26, 2016 at 6:25 PM, Guy Harris wrote: > On Apr 26, 2016, at 8:01 AM, Martin Mathieson > wrote: > >> I had a need to convert a file with RAW_IP encap to ETHERNET encap >> today, so I tried >> >> editcap -T ether rawip.cap ethernet.pcap >> >> This did change the encap but didn't write

Re: [Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Guy Harris
On Apr 26, 2016, at 8:01 AM, Martin Mathieson wrote: > I had a need to convert a file with RAW_IP encap to ETHERNET encap > today, so I tried > > editcap -T ether rawip.cap ethernet.pcap > > This did change the encap but didn't write a fake ethernet header > (apologies if this was fixed recent

[Wireshark-dev] Converting a PCAP file (changing encap from RAW_IP to ETHERNET)

2016-04-26 Thread Martin Mathieson
Hi, I had a need to convert a file with RAW_IP encap to ETHERNET encap today, so I tried editcap -T ether rawip.cap ethernet.pcap This did change the encap but didn't write a fake ethernet header (apologies if this was fixed recetly, my snapshot here is a couple of months old). I was able to co