Once its working with tcpdump then try the capture with Wireshark. This way you can convert a pcap file to have the same. or with tcpdump, just do 'sudo tcpdump -r inputpcapfile -w outputpcapfile'.

The saved file will have the same endianess of your computer. Use tcpdump on the same machine running tcpreplay (excluding port 22 if you are connected with ssh) tcpdump -i eth0 -p -Q out -e not port 22. Tshark can do that using the following instruction: tshark -r (path of pcap file) -E separator, -E headery -T fields -e field1 -e field2. To convert endianness of a pcap file, you can also use wireshark or tcpdump: With wireshark, just open the file and save it, without modification. Exclude Wireshark from the initial testing. NetworkMiner can also do that by simply parsing the pre-captured PCAP file. I think editcap may help me, but I'm not sure what the proper command would be. Take a closer look at what tcpreplay is sending: tcpreplay -v -A e -i eth0 pcap.pcap. Designed network management and ticketing system using Spiceworks to monitor. Basically, 10 PCAP files, each file spanning about 50 seconds. Wireshark PCAP GE Facility Commander Card Access Systems Isonas card access. I want to split the PCAP file into 10 smaller PCAPs based on the time column. This command will capture the TCP stream from the http. I have a PCAP file I exported from wireshark that's rather large. The file format pcap-ng extends the simple pcap format features with the options to store more capture related information, like extended time stamp precision, capture interface information, capture statistics, mixed link layer types, name resolution information, user comments, etc.

Wireshark pcap spiceworks pcap