RE: Format of Etheral pcap files

My original question wasn't very clear. I want to send the packets in the
capture file over the network to test an app. that is supposed to capture
them. For example, I could send them with WinPcap. Given that scenario, does
the ethereal dump contain the original packet data is it encoded? Is there a
header, etc?

 

Many thanks,

 

  _____  

From: [email protected]
[mailto:[email protected]] On Behalf Of Visser, Martin
Sent: Friday, July 28, 2006 1:25 AM
To: Ethereal user support
Subject: RE: [Ethereal-users] Format of Etheral pcap files

 

Andrew,

 

When you say "send a file" what exactly do you mean? Doing a FTP or SMB
transfer of the file isn't going to do anything to test your app.

 

However if what you are asking is "is there enough info in the pcap file to
enable a tool to replicate the network traffic it saw?" the answer is a
cautious yes. The standard tool to use the data found in a pcap file and
send it back into the network is the "tcpreplay" suite of tools -
http://tcpreplay.synfin.net/trac/ . 

 

 

Martin

 

  _____  

From: [email protected] on behalf of Andrew Chalk
Sent: Fri 28/07/2006 3:00 PM
To: Ethereal Users
Subject: [Ethereal-users] Format of Etheral pcap files

I want to send a series of specific protocol packets across a network to
test an application that is supposed to capture and analyze the packets. Can
I just send an Ethereal pcap file containing the correct protocol packets?
I.e does it contain the packets in an uncorrupted form? 

 

Many thanks.

_______________________________________________
Ethereal-users mailing list
[email protected]
http://www.ethereal.com/mailman/listinfo/ethereal-users