CODEWITHSUNDEEP
javawiresharkpcap
Seb
Seb

Reputation: 471

pcap-ng to pcap using Java

Is there anyway to convert pcap-ng files to pcap using Java (without the use of editcap)?

I have noticed that some pcaps are read as .pcap format but when I have a look in Wireshark 'Summary' it is recognised as pcap-ng format.

Thanks for any help in advance Shiv

Upvotes: 0

Views: 990

Answers (1)

user862787
user862787

Reputation:

Is there anyway to convert pcap-ng files to pcap using Java (without the use of editcap)?

Write a Java program that uses libpcap (using a wrapper around libpcap) to read a capture file and write it out again. Newer versions of libpcap can read pcapng files that don't have multiple link-layer types, just as they can read pcap files; they currently only support writing pcap files, not pcapng files.

(This won't work on Windows, as there isn't yet a version of WinPcap based on one of those newer versions of libpcap.)

I have noticed that some pcaps are read as .pcap format but when I have a look in Wireshark 'Summary' it is recognised as pcap-ng format.

If by that you mean "I have noticed that some files that Wireshark recognizes as pcapng can be read by programs that use libpcap to read capture files", that's true, but doesn't mean that they're "read as .pcap format" - as I said above, newer versions of libpcap can read some pcapng files using the same APIs that can read pcap files.

This, by the way, may mean that you don't need to convert the files to pcap. The only reason you'd need to convert a pcapng file to pcap is to allow programs that only read pcap files, such as programs using older versions of libpcap (or current versions of WinPcap), or programs that have their own code to read pcap files and that doesn't support pcapng, to read those files.

Upvotes: 1

Related Questions