LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-21-2011, 07:11 AM   #1
gabriel01
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Rep: Reputation: 0
Arrow How to convert Tcpdump output file to a Pcap format?


Hi All,

How to convert Tcpdump output file to a Pcap format? Is there such way?

This is what i mean:

tcpdump -i eth0 >> test.out

Now i want to convert test.out to Pcap so It's readable via Wireshark.

Thanks in advance for your help

Last edited by gabriel01; 02-21-2011 at 07:16 AM.
 
Old 02-21-2011, 08:50 AM   #2
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
Quote:
Originally Posted by gabriel01 View Post
Hi All,

How to convert Tcpdump output file to a Pcap format? Is there such way?

This is what i mean:

tcpdump -i eth0 >> test.out

Now i want to convert test.out to Pcap so It's readable via Wireshark.

Thanks in advance for your help
Try with the parm -w to capture directly in pcap format:

Code:
tcpdump -i eth0 -w test.pcap
Hope this helps!
 
Old 02-21-2011, 08:50 AM   #3
Nylex
LQ Addict
 
Registered: Jul 2003
Location: London, UK
Distribution: Slackware
Posts: 7,464

Rep: Reputation: Disabled
Use tcpdump's -w option:

tcpdump -i eth0 -w test.out
 
Old 02-21-2011, 08:53 AM   #4
hogar.strashni
Member
 
Registered: Dec 2007
Distribution: cp6
Posts: 44

Rep: Reputation: 2
output of tcpdump is plain text generated by SOME of the fields in the header, thus many informations about a packet have been lost and total reconstruction is impossible. If you want to compare output of two programs, capture packets with tcpdump and log them as binaries.
Code:
sudo tcpdump -i eth0 -w test.out
After that you will be able to read from a file by
Code:
sudo tcpdump -i eth0 -r test.out
and as well to use it with wireshark. Also I may suggest you to modify snap length of captured packets to maximum 65535 or 0(if 0 is passed to -s argument it is interpreted as maximum which is 2^16 = 65535). Default is 68 or 96B(depending on the platform) and sometimes it isn't enough for all headers to be captured and dumped to binaries for later analysis. So, code with snap length modification would be
Code:
sudo tcpdump -i eth0 -w test.out -s 65535
. No need to use -s when reading from a file!

Last edited by hogar.strashni; 02-21-2011 at 08:57 AM.
 
Old 02-23-2011, 06:22 AM   #5
gabriel01
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
Thanks Heaps guys
 
Old 02-23-2011, 06:23 AM   #6
gabriel01
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
All repped!
 
Old 11-26-2012, 04:50 AM   #7
linuxexplore
LQ Newbie
 
Registered: Oct 2012
Location: India
Distribution: CentOS, Ubuntu
Posts: 6
Blog Entries: 1

Rep: Reputation: Disabled
Thumbs up

I have a small how to on this topic, i hope it will be help for others:
Use tcpdump to capture pcap wireshark dump file
http://linuxexplore.com/2012/06/07/u...ireshark-dump/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I convert a tcpdump file into a friendlier format compubaby Linux - Networking 1 01-21-2009 10:54 AM
Odt File Convert To Odf Format DOUGLASdc6b Linux - Newbie 3 05-06-2008 07:27 AM
Is there a way to convert a PDF file to another format? M$ISBS General 10 05-09-2007 01:43 AM
tcpdump- link level header pcap shivaligupta Linux - Networking 1 04-28-2005 06:28 AM
how to convert pdf file to doc format. thushara Linux - Newbie 3 03-22-2005 06:29 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:08 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration