Converting pcap format from LINKTYPE_LINUX_SSL to LINKTYPE_ETHERNET

Question

I am trying to parse a pcap file however I need the linktype to be of LINKTYPE_ETHERNET, whereas the current file I have is using LINKTYPE_LINUX_SSL (documentation here http://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL.html)

Does anyone know if this could be a task I could complete using tshark, or am I going to have to hack something custom together to get the conversion.

Thanks!

Answer 1

This question has been asked (and answered) before on the wireshark's own version of stack overflow. But I'll repeat it here with a little more detail.

A linux cooked socket (SLL, not to be confused with SSL) is used by wireshark when capturing on all interfaces. It is a clever way to get around the fact that different interfaces have different MAC addresses. The SLL format has no MAC address on the link layer, which is beneficial when capturing from several interfaces but a problem when trying to transform it into a link layer that has MAC addresses.

tshark definitely cannot do it. tshark does not have the capability to change the format of a capture file.

editcap is wireshark's capture file editor, which is the tool that shall be used to change the format of a capture file. Still editcap only changes the file format, it cannot rewrite the packages themselves. And what you're asking about is about rewriting the link layer.

Nothing that ships together with wireshark is capable of rewriting the link layer inside of a capture file.

---

What you need is the (appropriately named) tcprewrite utility, which ships in the tcpreplay package. You need to add the MAC addresses on the command line to tcprewrite, both the source and destination addresses:

tcprewrite --dlt=enet --enet-dmac=52:54:00:11:11:11 \
    --enet-smac=52:54:00:22:22:22 -i in.pcap -o out.pcap

If you are confident that two devices are talking you can use the comma syntax of --enet-dmac and --enet-smac.

tcprewrite --dlt=enet --enet-dmac=52:54:00:11:11:11,52:54:00:22:22:22 \
    --enet-smac=52:54:00:22:22:22,52:54:00:11:11:11 -i in.pcap -o out.pcap

It is very likely that you want to use the second command, since it will look as a more believable ethernet conversation.

Most OSes have the tcpreplay in their package repositories.