On Wed, 12 Oct 2005, Ulf Lamping wrote:
> Jaap Keuter wrote:
>
> >Hi,
> >
> >It is not so much the -r option that is misleading, it's the synopsys
> >which doesn't make clear that the command can work on a range of packets.
> >I can suggest the following change for that:
> >
> >This changes the synopsys into
> >
> >SYNOPSYS
> > editcap [ -E error probability] [ -F file format ] [ -h ] [ -r ]
> > [ -s snaplen ] [ -t time adjustment ] [ -T encapsulation type ]
> > [ -v ] infile outfile [ [-record#] | [record#[-[record#]] ] [...]
> >
> >And even though it is more complicated it covers the ranges question.
> >
> Thanks for trying to fix this.
>
> IMHO Unfortunately, I think it complicates more than it solves.
>
> Why not simply add an (a few) *examples* of the usage.
>
> Regards, ULFL
I can see that problem. It would suggest a mix. An extention to the
synopsys (which I always use to get an overview of the possibilities)
shows that ranges are possible. A set of examples shows use of this (with
the -r option). Please review the examples and offer any suggestions of
better ones.
NAME
editcap - Edit and/or translate the format of capture files
SYNOPSYS
editcap [ -E error probability] [ -F file format ] [ -h ] [ -r ]
[ -s snaplen ] [ -t time adjustment ] [ -T encapsulation type ]
[ -v ] infile outfile [ record#[-record#] ... ]
.....
EXAMPLES
To see more detailed description of the options use:
editcap -h
To shrink the capture file by truncating the packets at 64 bytes
and writing it as Sun snoop file use:
editcap -s 64 -F snoop capture.pcap shortcapture.snoop
To delete packet 1000 from the capture file use:
editcap capture.pcap sans1000.pcap 1000
To crop a capture file to packet 200 to 750 inclusive use:
editcap -r capture.pcap small.pcap 200-750
To cut off a capture file at packet 500 use:
editcap capture.pcap 500.pcap 501-
or
editcap -r capture.pcap 500.pcap -500
To introduce 5% random errors in a capture file use:
editcap -E 0.05 capture.pcap capture_error.pcap
......
