Re: Packet Slicing

["j.snelders" <j.snelders () telfort nl>]

Hi Darrell,

Use the option -s
$ editcap -s 8 test.pcap truncate.pcap

HTH
Joan

On Thu, 15 Oct 2009 13:22:31 -0400 Darrell Arthur wrote:

> I want to strip the header information from a packet capture.  I've tried
> using editcap -C .. but that just strips a certain amount of bytes from
the
> end of each packet.  What can I use to strip the, say, first 8 bytes of
a
> packet??



       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe