Wireshark-users: Re: [Wireshark-users] Convert from NA Sniffer (Windows) 2.00x to libpcap

On Aug 6, 2009, at 6:58 PM, Rayne wrote:

I have some traffic that is of NA Sniffer (Windows) 2.00x type that I wish to convert to libpcap, so I can run it through TCP replay. I've been trying to use editcap:

editcap -F libpcap input.cap output.pcap

But I keep getting the error "Can't open or create output.pcap: Files from that network type can't be saved in that format".

On what type of network device did you capture the traffic?

"Files from that network type can't be saved in that format" means that the link-layer type is not one that Wireshark can write out in the file format in which you're trying to write it - and, for libpcap, that usually means that libpcap simply doesn't support that link-layer type.

Some Windows Sniffer network types not supported by Wireshark in libpcap format are:

ATM (Windows Sniffer ATM captures include the trailer for AAL5 PDUs; there's no libpcap type for that);

802.11 (we currently don't either discard the radio information or attempt to translate it into any of the forms supported by libpcap);

ISDN (there is no libpcap type compatible with Windows Sniffer ISDN captures);

	X.25 (there is no libpcap type for X.25);

	SDLC (there is no libpcap type for SDLC);

	Cisco HDLC (we currently don't discard the direction information).