0

I'm trying to get editcap to use a timestamp with nanoseconds, but I am unable to do this.

sample timestamp: 2022-01-23 23:10:05.237000000Z

TZ=UTC editcap -A '2022-01-23 23:10:05.237000000Z' -F nseclibpcap <some pcap file> <new trimmed pcap file>

This appears to only go the second rather than the nano second.

Does anyone have a sample cmd line on how they went about using nanoseconds?

Ruli
  • 2,592
  • 12
  • 30
  • 40
Silentterms
  • 41
  • 1

1 Answers1

0

At least one of your command-line options to editcap is incorrect. If you run editcap -F as suggested in the man page, you'll see that nseclibpcap is not a valid output capture file format. Try running the command again, but this time with a valid output capture file format specified, for example:

TZ=UTC editcap -A '2022-01-23 23:10:05.237000000Z' -F pcap infile.pcap outfile.pcap
Christopher Maynard
  • 5,702
  • 2
  • 17
  • 23