Background
Installing
$ git clone https://gitlab.com/catlib/catlib
$ cd catlib
$ make
$ cd ..
$ git clone https://gitlab.com/onics/onics
$ cd onics
$ ./configure
$ make
$ make test
$ sudo make install
$ make veryclean
$ make uninstall
Documentation
Manpages are available in onics/doc directory if you aren't installing locally. They are quite extensive.
If installed locally, starting with:
$ man onics
XPKT Format
PCAP format is outdated and not very extensible
First and foremost, the file header prevents just cat
ing files together.
First Programs
$ sudo tcpdump -i eth0 -c 5 -w file1.pcap
$ sudo pktin eth0 > file2.xpkt
$ sudo chown myname file1.pcap file2.xpkt
$ tcpdump -r file1.pcap
$ xpktdump file2.xpkt
$ pc2xpkt file1.pcap file1.xpkt
or
$ pc2xpkt file1.pcap > file1.xpkt
or
$ pc2xpkt < file1.pcap > file1.xpkt
or
$ cat file1.pcap | pc2xpkt > file1.xpkt
$ xpktdump file1.xpkt
Something we can't do w/ tcpdump
$ cat file1.xpkt file2.xpkt > merged.xpkt
$ xpktdump merged.xpkt
$ cat file1.xpkt file2.xpkt | xpktdump
Convert back to pcap:
$ xpkt2pc file2.xpkt file2.pcap
or
$ xpkt2pc < file2.xpkt > file2.pcap
or
$ xpkt2pc file2.xpkt > file2.pcap
or
$ cat file2.xpkt | xpkt2pc > file2.pcap
$ tcpdump -r file2.pcap
$ xpkt2pc file2.xpkt | tcpdump -r -
$ cat file1.xpkt file2.xpkt | xpkt2pc | tcpdump -r | less
Sending packets:
$ sudo tcpdump -i eth0 # in one terminal
$ sudo pktout -i eth0 file1.xpkt
or
$ sudo pktout -i eth0 < file1.xpkt
or
$ cat file1.xpkt | sudo pktout -i eth0
Summary
Unless otherwise stated, our shows are released under a Creative Commons Attribution-ShareAlike 3.0 Unported (CC BY-SA 3.0) license.
The HPR Website Design is released to the Public Domain.