ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] Removing bytes from the beginning of each frame?

From: "Barta Frank-QKBF84" <frank.barta@xxxxxxxxxxxx>
Date: Wed, 17 Feb 2010 10:29:36 -0500
I've been working on finding a method to remove RadioTap headers from an 802.11 capture. I've found that I can change the file encapsulation in editcap from ieee-802-11-radio to regular ieee-802-11, however because the packet bytes for the radiotap header still exists this results in mostly garbage data.
I know that the radiotap header is going to be the first 20 bytes of every frame in the given capture I am working with. Editcap appears to only have a method for chopping data off of the packet at the end, and not at the beginning. Does anyone know of or have a tool that will allow me to remove the first 20 bytes from every frame in a capture?

Frank Barta


Specialist - Technical Support III

Enterprise Wireless LAN Division


Motorola Enterprise Mobility Business

US & Canada  1-800-653-5350

Local / International   1-631-738-6213