Wireshark · Wireshark-users: [Wireshark-users] Editcap 1.2.15 not working

[Rayne <hjazz6@xxxxxxxxx>]

Hi all,

I have the following command to extract packets 1 to 5 from a pcap file using editcap.

    editcap -r test.pcap output.pcap 1 2 3 4 5

This worked on editcap 1.1.1, but with version 1.2.15, the output.pcap is always empty, i.e. only 24 bytes. What could be wrong with it?

BTW, I know I could have used 1-5 instead, but I was just doing a quick test because later I will have to use this syntax.

Thank you.

Regards,

Rayne