SYNOPSIS
editcap [ -a <frame:comment> ] [ -A <start time> ] [ -B <stop time> ] [ -c <packets per file> ] [ -C [offset:]<choplen> ] [ -E <error probability> ] [ -F <file format> ] [ -i <seconds per file> ] [ -o <change offset> ] [ -L ] [ -r ] [ -s <snaplen> ] [ -S <strict time adjustment> ] [ -t <time adjustment> ] [ -T <encapsulation type> ] [ -V ] [ --inject-secrets <secrets type>,<file> ] [ --discard-all-secrets ] [ --capture-comment <comment> ] [ --discard-capture-comment ] infile outfile [ packet#[-packet#] … ]
editcap -d -D <dup window> -w <dup time window> [ -V ] [ -I <bytes to ignore> ] [ --skip-radiotap-header ] infile outfile
editcap -h|--help
editcap -v|--version
DESCRIPTION
Editcap is a program that reads some or all of the captured packets from the infile, optionally converts them in various ways and writes the resulting packets to the capture outfile (or outfiles).
By default, it reads all packets from the infile and writes them to the outfile in pcapng file format. Use '-' for infile or outfile to read from standard input or write to standard output, respectively.
The -A and -B option allow you to limit the time range from which packets are read from the infile.
An optional list of packet numbers can be specified on the command tail; individual packet numbers separated by whitespace and/or ranges of packet numbers can be specified as start-end, referring to all packets from start to end. By default the selected packets with those numbers will not be written to the capture file. If the -r flag is specified, the whole packet selection is reversed; in that case only the selected packets will be written to the capture file.
Editcap can also be used to remove duplicate packets. Several different options (-d, -D and -w) are used to control the packet window or relative time window to be used for duplicate comparison.
Editcap can be used to assign comment strings to frame numbers.
Editcap is able to detect, read and write the same capture files that are supported by Wireshark. The input file doesn’t need a specific filename extension; the file format and an optional gzip, zstd or lz4 compression will be automatically detected. Near the beginning of the DESCRIPTION section of wireshark(1) or https://www.wireshark.org/docs/man-pages/wireshark.html is a detailed description of the way Wireshark handles this, which is the same way Editcap handles this.
Editcap can write the file in several output formats. The -F flag can be used to specify the format in which to write the capture file; editcap -F provides a list of the available output formats.
OPTIONS
- -a <framenum:comment>
-
For the specified frame number, assign the given comment string. Can be repeated for multiple frames. Quotes should be used with comment strings that include spaces.
- -A <start time>
-
Reads only the packets whose timestamp is on or after start time. The time is given in ISO 8601 format, either YYYY-MM-DD HH:MM:SS[.nnnnnnnnn][Z|±hh:mm] or YYYY-MM-DDTHH:MM:SS[.nnnnnnnnn][Z|±hh:mm] . The fractional seconds are optional, as is the time zone offset from UTC (in which case local time is assumed). Unix epoch timestamps (floating point format) are also accepted.
- -B <stop time>
-
Reads only the packets whose timestamp is b