Wireshark - 1.0 Betriebsanweisung PDF herunterladen (Seite 274)

<output-filename> specifies output filename (use - for standard output)

[options] are one or more of the following

-h : Display this help message

-d : Generate detailed debug of parser states

-o hex|oct : Parse offsets as (h)ex or (o)ctal. Default is hex

-l typenum : Specify link-layer type number. Default is 1 (Ethernet).

See net/bpf.h for list of numbers.

-q : Generate no output at all (automatically turns off -d)

-e l3pid : Prepend dummy Ethernet II header with specified L3PID (in

HEX)

Example: -e 0x800

-i proto : Prepend dummy IP header with specified IP protocol (in

DECIMAL).

Automatically prepends Ethernet header as well.

Example: -i 46

-m max-packet : Max packet length in output, default is 64000

-u srcp,destp : Prepend dummy UDP header with specified dest and source ports

(in DECIMAL).

Automatically prepends Ethernet and IP headers as well

Example: -u 30,40

-T srcp,destp : Prepend dummy TCP header with specified dest and source ports

(in DECIMAL).

Automatically prepends Ethernet and IP headers as well

Example: -T 50,60

-s srcp,dstp,tag: Prepend dummy SCTP header with specified dest/source ports

and verification tag (in DECIMAL).

Automatically prepends Ethernet and IP headers as well

Example: -s 30,40,34

-S srcp,dstp,ppi: Prepend dummy SCTP header with specified dest/source ports

and verification tag 0. It also prepends a dummy SCTP DATA

chunk header with payload protocol identifier ppi.

Example: -S 30,40,34

-t timefmt : Treats the text before the packet as a date/time code; the

specified argument is a format string of the sort supported

by strptime.

Example: The time "10:15:14.5476" has the format code

"%H:%M:%S."

NOTE: The subsecond component delimiter must be specified

(.) but no pattern is required; the remaining number

is assumed to be fractions of a second.

-w <filename> Write the capture file generated by text2pcap to <filename>. The de-

fault is to write to standard output.

-h Display the help message

-d Displays debugging information during the process. Can be used

multiple times to generate more debugging information.

-q Be completely quiet during the process.

-o hex|oct Specify the radix for the offsets (hex or octal). Defaults to hex. This

corresponds to the -A option for od.

-l Specify the link-layer type of this packet. Default is Ethernet(1). See

net/bpf.h for the complete list of possible encapsulations. Note that

this option should be used if your dump is a complete hex dump of

an encapsulated packet and you wish to specify the exact type of en-

capsulation. Example: -l 7 for ARCNet packets.

-e l3pid Include a dummy Ethernet header before each packet. Specify the

L3PID for the Ethernet header in hex. Use this option if your dump

has Layer 3 header and payload (e.g. IP header), but no Layer 2 en-

capsulation. Example: -e 0x806 to specify an ARP packet.

For IP packets, instead of generating a fake Ethernet header you can

also use -l 12 to indicate a raw IP packet to Wireshark. Note that -l

12 does not work for any non-IP Layer 3 packet (e.g. ARP), whereas

generating a dummy Ethernet header with -e works for any sort of L3

Related command line tools

259

1 2 ... 269 270 271 272 273 274 275 276 277 278 279 ... 283 284

Wireshark - 1.0 Betriebsanweisung Seite 274

Kommentare zu diesen Handbüchern