Wireshark-users: [Wireshark-users] Removing bytes from the beginning of each frame?
From: "Barta Frank-QKBF84" <[email protected]>
Date: Wed, 17 Feb 2010 10:29:36 -0500
Hello,
 
I've been working on finding a method to remove RadioTap headers from an 802.11 capture. I've found that I can change the file encapsulation in editcap from ieee-802-11-radio to regular ieee-802-11, however because the packet bytes for the radiotap header still exists this results in mostly garbage data.
 
I know that the radiotap header is going to be the first 20 bytes of every frame in the given capture I am working with. Editcap appears to only have a method for chopping data off of the packet at the end, and not at the beginning. Does anyone know of or have a tool that will allow me to remove the first 20 bytes from every frame in a capture?
 
Regards,
 

Frank Barta

CCNA, CWNA

Specialist - Technical Support III

Enterprise Wireless LAN Division

 

Motorola Enterprise Mobility Business

US & Canada  1-800-653-5350

Local / International   1-631-738-6213