>
> If you're willing to modify editcap, you could try making a special modified version of it that maps WTAP_ENCAP_NETTL_RAW_IP and WTAP_ENCAP_NETTL_ETHERNET to WTAP_ENCAP_RAW_IP, and, for WTAP_ENCAP_NETTL_ETHERNET packets, discards non-IP packets (don't write them out) and strips off the first 14 bytes of packet data.
>
Thanks for your help, I got a working version now converting to
pcap-format with encapsulation type for Ethernet, generating a bogus
ether header for type IPv4. In the end it was just a few lines of code
in libpcap.c and pcap-common.c.
Cheers,
Andrej
