Wireshark · Ethereal-users: Re: [Ethereal-users] Filtering with EDITCAP

[Guy Harris <gharris@xxxxxxxxx>]

Ken Young wrote:
> Can some provide me with an example where I can take a saved capture file
> and run EDITCAP.EXE against it to strip out (exclude) certain protocols?

No, they can't, because editcap doesn't dissect packets, so it has no 
idea what protocols are in a packet, and thus cannot exclude certain 
protocols when processing a capture file.

If you want to strip out certain protocols, you'd do that with 
tethereal, which *does* dissect packets.

Note, by the way, that a reassembled packet (i.e., one whose data is 
contained in more than one lower-level packets) will be identified as 
being a packet with a given protocol only in the last of the lower-level 
packets, so the other packets wouldn't be stripped out in that case.

> Ie. Remove CDP and STP packets via command line.

	tethereal -r {input file} -w {output file} -R "not cdp and not stp"