介绍一下editcap的各种参数。
1、-F
2、-T
3、-s
4、-c
5、-C
1 editcap -L -C 12:4 capture_vlan.pcap capture_no_vlan.pcap
至于-C的参数,变化更是多得很,这里暂时就不展开了。不过不幸的是,好像老版本的-C命令不支持带冒号的参数,就比如上面这个例子。
6、-A
7、-D
To shrink the capture file by truncating the packets at 64 bytes and writing it as Sun snoop file use:
editcap -s 64 -F snoop capture.pcap shortcapture.snoop
To delete packet 1000 from the capture file use:
editcap capture.pcap sans1000.pcap 1000
To limit a capture file to packets from number 200 to 750 (inclusive) use:
editcap -r capture.pcap small.pcap 200-750
To get all packets from number 1-500 (inclusive) use:
editcap -r capture.pcap first500.pcap 1-500
or
editcap capture.pcap first500.pcap 501-9999999
To exclude packets 1, 5, 10 to 20 and 30 to 40 from the new file use:
editcap capture.pcap exclude.pcap 1 5 10-20 30-40
To select just packets 1, 5, 10 to 20 and 30 to 40 for the new file use:
editcap -r capture.pcap select.pcap 1 5 10-20 30-40
To remove duplicate packets seen within the prior four frames use:
editcap -d capture.pcap dedup.pcap
To remove duplicate packets seen within the prior 100 frames use:
editcap -D 101 capture.pcap dedup.pcap
To remove duplicate packets seen equal to or less than 1/10th of a second:
editcap -w 0.1 capture.pcap dedup.pcap
To display the MD5 hash for all of the packets (and NOT generate any real output file):
editcap -v -D 0 capture.pcap /dev/null
or on Windows systems
editcap -v -D 0 capture.pcap NUL
To introduce 5% random errors in a capture file use:
editcap -E 0.05 capture.pcap capture_error.pcap