ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] regenerate pcap-format from tcpdump -r output

From: Andrej van der Zee <andrejvanderzee@xxxxxxxxx>
Date: Wed, 22 Jul 2009 14:36:45 +0900
Hi,

I was wondering if it is possible to regenerate pcap from the
text-output from tcpdump. I mean something like this:

tcpdump  -r dump.pcap  -n  -q -e > dump.txt
some-tool dump.txt > dump2.pcap

And then dupm.pcap equals dump2.pcap.

Thank you,
Andrej