Wireshark · Wireshark-users: Re: [Wireshark-users] Packet Slicing

["j.snelders" <j.snelders@xxxxxxxxxx>]

Hi Darrell,

Use the option -s
$ editcap -s 8 test.pcap truncate.pcap

HTH
Joan

On Thu, 15 Oct 2009 13:22:31 -0400 Darrell Arthur wrote:

>I want to strip the header information from a packet capture.  I've tried
>using editcap -C .. but that just strips a certain amount of bytes from
the
>end of each packet.  What can I use to strip the, say, first 8 bytes of
a
>packet??