Included with Wireshark is a small utility called editcap, which is a command-line utility for working with capture files. Its main function is to remove packets from capture files, but it can also be used to convert capture files from one format to another, as well as to print information about capture files.
Example D.5. Help information available from editcap
Editcap 1.6.0 (SVN Rev 37205 from /trunk-1.6) Edit and/or translate the format of capture files. See http://www.wireshark.org for more information. Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ] <infile> and <outfile> must both be present. A single packet or a range of packets can be selected. Packet selection: -r keep the selected packets; default is to delete them. -A <start time> only output packets whose timestamp is after (or equal to) the given time (format as YYYY-MM-DD hh:mm:ss). -B <stop time> only output packets whose timestamp is before the given time (format as YYYY-MM-DD hh:mm:ss). Duplicate packet removal: -d remove packet if duplicate (window == 5). -D <dup window> remove packet if duplicate; configurable <dup window> Valid <dup window> values are 0 to 1000000. NOTE: A <dup window> of 0 with -v (verbose option) is useful to print MD5 hashes. -w <dup time window> remove packet if duplicate packet is found EQUAL TO OR LESS THAN <dup time window> prior to current packet. A <dup time window> is specified in relative seconds (e.g. 0.000001). NOTE: The use of the 'Duplicate packet removal' options with other editcap options except -v may not always work as expected. Specifically the -r, -t or -S options will very likely NOT have the desired effect if combined with the -d, -D or -w. Packet manipulation: -s <snaplen> truncate each packet to max. <snaplen> bytes of data. -C <choplen> chop each packet by <choplen> bytes. Positive values chop at the packet beginning, negative values at the packet end. -t <time adjustment> adjust the timestamp of each packet; <time adjustment> is in relative seconds (e.g. -0.5). -S <strict adjustment> adjust timestamp of packets if necessary to insure strict chronological increasing order. The <strict adjustment> is specified in relative seconds with values of 0 or 0.000001 being the most reasonable. A negative adjustment value will modify timestamps so that each packet's delta time is the absolute value of the adjustment specified. A value of -0 will set all packets to the timestamp of the first packet. -E <error probability> set the probability (between 0.0 and 1.0 incl.) that a particular packet byte will be randomly changed. Output File(s): -c <packets per file> split the packet output to different files based on uniform packet counts with a maximum of <packets per file> each. -i <seconds per file> split the packet output to different files based on uniform time intervals with a maximum of <seconds per file> each. -F <capture type> set the output file type; default is libpcap. an empty "-F" option will list the file types. -T <encap type> set the output file encapsulation type; default is the same as the input file. an empty "-T" option will list the encapsulation types. Miscellaneous: -h display this help and exit. -v verbose output. If -v is used with any of the 'Duplicate Packet Removal' options (-d, -D or -w) then Packet lengths and MD5 hashes are printed to standard-out.
Example D.6. Capture file types available from editcap
$ editcap -F editcap: option requires an argument -- F editcap: The available capture file types for the "-F" flag are: 5views - Accellent 5Views capture btsnoop - Symbian OS btsnoop commview - TamoSoft CommView dct2000 - Catapult DCT2000 trace (.out format) eyesdn - EyeSDN USB S0/E1 ISDN trace format k12text - K12 text file lanalyzer - Novell LANalyzer libpcap - Wireshark/tcpdump/... - libpcap modlibpcap - Modified tcpdump - libpcap netmon1 - Microsoft NetMon 1.x netmon2 - Microsoft NetMon 2.x nettl - HP-UX nettl trace ngsniffer - NA Sniffer (DOS) ngwsniffer_1_1 - NA Sniffer (Windows) 1.1 ngwsniffer_2_0 - NA Sniffer (Windows) 2.00x niobserverv - Network Instruments Observer nokialibpcap - Nokia tcpdump - libpcap nseclibpcap - Wireshark - nanosecond libpcap nstrace10 - NetScaler Trace (Version 1.0) nstrace20 - NetScaler Trace (Version 2.0) pcapng - Wireshark - pcapng rf5 - Tektronix K12xx 32-bit .rf5 format rh6_1libpcap - RedHat 6.1 tcpdump - libpcap snoop - Sun snoop suse6_3libpcap - SuSE 6.3 tcpdump - libpcap visual - Visual Networks traffic capture
$ editcap -T editcap: option requires an argument -- T editcap: The available encapsulation types for the "-T" flag are: ap1394 - Apple IP-over-IEEE 1394 arcnet - ARCNET arcnet_linux - Linux ARCNET ascend - Lucent/Ascend access equipment atm-pdus - ATM PDUs atm-pdus-untruncated - ATM PDUs - untruncated atm-rfc1483 - RFC 1483 ATM bacnet-ms-tp - BACnet MS/TP ber - ASN.1 Basic Encoding Rules bluetooth-h4 - Bluetooth H4 bluetooth-h4-linux - Bluetooth H4 with linux header bluetooth-hci - Bluetooth without transport layer can20b - Controller Area Network 2.0B chdlc - Cisco HDLC chdlc-with-direction - Cisco HDLC with Directional Info cosine - CoSine L2 debug log dct2000 - Catapult DCT2000 docsis - Data Over Cable Service Interface Specification dpnss_link - Digital Private Signalling System No 1 Link Layer dvbci - DVB-CI (Common Interface) enc - OpenBSD enc(4) encapsulating interface erf - Endace Record File ether - Ethernet ether-nettl - Ethernet with nettl headers fc2 - Fibre Channel FC-2 fc2sof - Fibre Channel FC-2 With Frame Delimiter fddi - FDDI fddi-nettl - FDDI with nettl headers fddi-swapped - FDDI with bit-swapped MAC addresses flexray - FlexRay frelay - Frame Relay frelay-with-direction - Frame Relay with Directional Info gcom-serial - GCOM Serial gcom-tie1 - GCOM TIE1 gprs-llc - GPRS LLC gsm_um - GSM Um Interface hhdlc - HiPath HDLC i2c - I2C ieee-802-11 - IEEE 802.11 Wireless LAN ieee-802-11-avs - IEEE 802.11 plus AVS WLAN header ieee-802-11-netmon - IEEE 802.11 plus Network Monitor radio header ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information ieee-802-11-radiotap - IEEE 802.11 plus radiotap WLAN header ieee-802-16-mac-cps - IEEE 802.16 MAC Common Part Sublayer ios - Cisco IOS internal ip-over-fc - RFC 2625 IP-over-Fibre Channel ipfix - IPFIX ipmb - Intelligent Platform Management Bus ipnet - Solaris IPNET irda - IrDA isdn - ISDN jfif - JPEG/JFIF juniper-atm1 - Juniper ATM1 juniper-atm2 - Juniper ATM2 juniper-chdlc - Juniper C-HDLC juniper-ether - Juniper Ethernet juniper-frelay - Juniper Frame-Relay juniper-ggsn - Juniper GGSN juniper-mlfr - Juniper MLFR juniper-mlppp - Juniper MLPPP juniper-ppp - Juniper PPP juniper-pppoe - Juniper PPPoE juniper-vp - Juniper Voice PIC k12 - K12 protocol analyzer lapb - LAPB lapd - Lapd header lapd - LAPD layer1-event - EyeSDN Layer 1 event lin - Local Interconnect Network linux-atm-clip - Linux ATM CLIP linux-sll - Linux cooked-mode capture ltalk - Localtalk most - Media Oriented Systems Transport mpeg - MPEG mtp2 - SS7 MTP2 mtp2-with-phdr - MTP2 with pseudoheader mtp3 - SS7 MTP3 mux27010 - MUX27010 nstrace10 - NetScaler Encapsulation 1.0 of Ethernet nstrace20 - NetScaler Encapsulation 2.0 of Ethernet null - NULL packetlogger - PacketLogger pflog - OpenBSD PF Firewall logs pflog-old - OpenBSD PF Firewall logs, pre-3.4 ppi - Per-Packet Information header ppp - PPP ppp-with-direction - PPP with Directional Info prism - IEEE 802.11 plus Prism II monitor mode header raw-icmp-nettl - Raw ICMP with nettl headers raw-icmpv6-nettl - Raw ICMPv6 with nettl headers raw-telnet-nettl - Raw telnet with nettl headers rawip - Raw IP rawip-nettl - Raw IP with nettl headers rawip4 - Raw IPv4 rawip6 - Raw IPv6 redback - Redback SmartEdge sccp - SS7 SCCP sdlc - SDLC sita-wan - SITA WAN packets slip - SLIP socketcan - SocketCAN symantec - Symantec Enterprise Firewall tnef - Transport-Neutral Encapsulation Format tr - Token Ring tr-nettl - Token Ring with nettl headers tzsp - Tazmen sniffer protocol unknown - Unknown unknown-nettl - Unknown link-layer type with nettl headers usb - Raw USB packets usb-linux - USB packets with Linux header usb-linux-mmap - USB packets with Linux header and padding user0 - USER 0 user1 - USER 1 user10 - USER 10 user11 - USER 11 user12 - USER 12 user13 - USER 13 user14 - USER 14 user15 - USER 15 user2 - USER 2 user3 - USER 3 user4 - USER 4 user5 - USER 5 user6 - USER 6 user7 - USER 7 user8 - USER 8 user9 - USER 9 whdlc - Wellfleet HDLC wpan - IEEE 802.15.4 Wireless PAN wpan-nofcs - IEEE 802.15.4 Wireless PAN with FCS not present wpan-nonask-phy - IEEE 802.15.4 Wireless PAN non-ASK PHY x25-nettl - X25 with nettl headers x2e-serial - X2E serial line capture x2e-xoraya - X2E Xoraya