Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] rev 51886: /trunk/ /trunk/doc/: editcap.

From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Mon, 9 Sep 2013 22:19:13 +0200
On Mon, Sep 09, 2013 at 07:39:45PM +0000, cmaynard@xxxxxxxxxxxxx wrote:
> http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=51886
[...]
>  One more example here for posterity:  Given the following 75 byte packet, there
>  are 8 different ways to chop the 2 regions marked as 10 and 20 in a single pass:
>  
>      <--------------------------- 75 ---------------------------->
>   
>      +---+-------+-----------+---------------+-------------------+
>      | 5 |   10  |     15    |       20      |         25        |
>      +---+-------+-----------+---------------+-------------------+
>  
>  1) editcap -C 5:10 -C -25:-20 in.pcap out.pcap
>  2) editcap -C 5:10 -C 50:-20 in.pcap out.pcap
>  3) editcap -C -70:10 -C -25:-20 in.pcap out.pcap
>  4) editcap -C -70:10 -C 50:-20 in.pcap out.pcap
>  5) editcap -C 30:20 -C -60:-10 in.pcap out.pcap
>  6) editcap -C 30:20 -C 15:-10 in.pcap out.pcap
>  7) editcap -C -45:20 -C -60:-10 in.pcap out.pcap
>  8) editcap -C -45:20 -C 15:-10 in.pcap out.pcap

How about adding an examples section to the manpage and put the example
above in there? It's way too good to "waste" on just a commit message.

Ciao
        Jörg
-- 
Joerg Mayer                                           <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.