The output_dump file will contain all packets except the first 10 packets. Make sure wireshark/ethereal package is installed to use the editcap.ġ1 Practical Examples Of edicap Usage Example 1: Discard set of packets from the beginning of input_dump file Editicap utility makes the job easier by giving only relevant packets, so it could be loaded by network analyzer tool in quick time.Įditcap is available in the wireshark package.

In this situation, we cant use the network packet analyzer (wireshark or ethereal) to load the huge dump file in a single shoh, as it will be a CPU intensive process and the system may hang. Let us assume the scenario where you have to analyze only some specific packet types in a huge dump file.

All feature results in less time consumption when processing or analyzing packets.

Make the job easier for network analyzer tool by loading only selective packets, instead of loading whole dump.

Ability to read from a compressed dump file.

Translate the capture file from one format to another.

Divide a dump file into multiple files.

In this article, let us review 11 practical examples on how-to use editcap to handle the packet dumps effectively.įollowing are the main reason to use editcap command.

We can pass various options to editcap to get our preferred packets. Instead, it operates on the captured packets and writes some of the required packets into another file. Editcap does not perform packet captures like ethereal. This article is written by Balakrishnan MĮditcap utility is used to select or remove specific packets from dump file and translate them into a given format.

Wireshark example