4

I have a a few folders with 300 to 400 files each. The files are wireshark captures in .pcapng format. I would like to write a shell script that opens every file and saves it into a new folder using wireshark .tcpdump format.

2 Answers 2

5

Ok, found the tool called editcap. You only have to call editcap i.pcapng o.pcap into a loop:

# Recursively convert all *.pcapng files to *.pcap
cd /path/to/folders   # the path to folder where your folders containing '*.pcapng' files are in
find . -type f -name '*.pcapng' -print0 | while IFS= read -r -d '' f; do editcap -F libpcap "$f" "${f%.pcapng}.pcap"; done

(since I'm lazy, I mostly used Radu's script, aside from adding double quotes for ${f%.pcapng}.pcap)

You can check the editcap manual for more options.

Here a example:

braiam@bt:~/lab$ ls
something.pcapng
braiam@bt:~/lab$ find . -type f -name '*.pcapng' -print0 | while IFS= read -r -d '' f; do editcap -F libpcap "$f" "${f%.pcapng}.pcap"; done
braiam@bt:~/lab$ file something.pcap something.pcapng 
something.pcap:   tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)
something.pcapng: pcap-ng capture file - version 1.0
braiam@bt:~/lab$ 

As you can see I converted the pcapng format into pcap/tcpdump format. The change of extension is an extra.

0

You could also use tshark:

tshark -F pcap -r {pcapng_file} -w {pcap_file}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .