Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] regenerate pcap-format from tcpdump -r output

From: Andrej van der Zee <andrejvanderzee@xxxxxxxxx>
Date: Wed, 22 Jul 2009 14:36:45 +0900
Hi,

I was wondering if it is possible to regenerate pcap from the
text-output from tcpdump. I mean something like this:

tcpdump  -r dump.pcap  -n  -q -e > dump.txt
some-tool dump.txt > dump2.pcap

And then dupm.pcap equals dump2.pcap.

Thank you,
Andrej