--- Begin Message ---
For posterity, I did:
ncat -l 12345 | tshark -r - -w - sll > w
where w is named pipe.
Instead of: ncat -l 12345 | tcpdump -r - -w - [pcap_filter] > w
Your answer leads me to this solution, I needed an upper-level tool.
Regards,
Le 19/01/2021 à 15:45, Michael Richardson a écrit :
Edouard Gaulué <lis...@e-gaulue.com> wrote:
> And is there any way to filter by link-type? In fact, I need only those
> LINUX_SLL.
pcap format can only contain a single link-type, so that's a no-op.
pcapng could contain multiple link-types, but tcpdump doesn't write that.
While wireshark can write pcapng, I don't think it writes multiple link types
to a single file, but of course, you could have concatenated multiple pcapng
files.
I'm not sure what tcpdump would do if it sees that :-)
--
] Never tell me the odds! | ipv6 mesh networks [
] Michael Richardson, Sandelman Software Works | IoT architect [
] m...@sandelman.ca http://www.sandelman.ca/ | ruby on rails [
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers