- FILE *output;
-
- if (!is_error)
- output = stdout;
- else
- output = stderr;
-
- fprintf(output, "Editcap %s"
-#ifdef SVNVERSION
- " (" SVNVERSION " from " SVNPATH ")"
-#endif
- "\n", VERSION);
- fprintf(output, "Edit and/or translate the format of capture files.\n");
- fprintf(output, "See http://www.wireshark.org for more information.\n");
- fprintf(output, "\n");
- fprintf(output, "Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]\n");
- fprintf(output, "\n");
- fprintf(output, "<infile> and <outfile> must both be present.\n");
- fprintf(output, "A single packet or a range of packets can be selected.\n");
- fprintf(output, "\n");
- fprintf(output, "Packet selection:\n");
- fprintf(output, " -r keep the selected packets; default is to delete them.\n");
- fprintf(output, " -A <start time> only output packets whose timestamp is after (or equal\n");
- fprintf(output, " to) the given time (format as YYYY-MM-DD hh:mm:ss).\n");
- fprintf(output, " -B <stop time> only output packets whose timestamp is before the\n");
- fprintf(output, " given time (format as YYYY-MM-DD hh:mm:ss).\n");
- fprintf(output, "\n");
- fprintf(output, "Duplicate packet removal:\n");
- fprintf(output, " -d remove packet if duplicate (window == %d).\n", DEFAULT_DUP_DEPTH);
- fprintf(output, " -D <dup window> remove packet if duplicate; configurable <dup window>\n");
- fprintf(output, " Valid <dup window> values are 0 to %d.\n", MAX_DUP_DEPTH);
- fprintf(output, " NOTE: A <dup window> of 0 with -v (verbose option) is\n");
- fprintf(output, " useful to print MD5 hashes.\n");
- fprintf(output, " -w <dup time window> remove packet if duplicate packet is found EQUAL TO OR\n");
- fprintf(output, " LESS THAN <dup time window> prior to current packet.\n");
- fprintf(output, " A <dup time window> is specified in relative seconds\n");
- fprintf(output, " (e.g. 0.000001).\n");
- fprintf(output, "\n");
- fprintf(output, " NOTE: The use of the 'Duplicate packet removal' options with\n");
- fprintf(output, " other editcap options except -v may not always work as expected.\n");
- fprintf(output, " Specifically the -r, -t or -S options will very likely NOT have the\n");
- fprintf(output, " desired effect if combined with the -d, -D or -w.\n");
- fprintf(output, "\n");
- fprintf(output, "Packet manipulation:\n");
- fprintf(output, " -s <snaplen> truncate each packet to max. <snaplen> bytes of data.\n");
- fprintf(output, " -C <choplen> chop each packet by <choplen> bytes. Positive values\n");
- fprintf(output, " chop at the packet beginning, negative values at the\n");
- fprintf(output, " packet end.\n");
- fprintf(output, " -t <time adjustment> adjust the timestamp of each packet;\n");
- fprintf(output, " <time adjustment> is in relative seconds (e.g. -0.5).\n");
- fprintf(output, " -S <strict adjustment> adjust timestamp of packets if necessary to insure\n");
- fprintf(output, " strict chronological increasing order. The <strict\n");
- fprintf(output, " adjustment> is specified in relative seconds with\n");
- fprintf(output, " values of 0 or 0.000001 being the most reasonable.\n");
- fprintf(output, " A negative adjustment value will modify timestamps so\n");
- fprintf(output, " that each packet's delta time is the absolute value\n");
- fprintf(output, " of the adjustment specified. A value of -0 will set\n");
- fprintf(output, " all packets to the timestamp of the first packet.\n");
- fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.)\n");
- fprintf(output, " that a particular packet byte will be randomly changed.\n");
- fprintf(output, "\n");
- fprintf(output, "Output File(s):\n");
- fprintf(output, " -c <packets per file> split the packet output to different files\n");
- fprintf(output, " based on uniform packet counts\n");
- fprintf(output, " with a maximum of <packets per file> each.\n");
- fprintf(output, " -i <seconds per file> split the packet output to different files\n");
- fprintf(output, " based on uniform time intervals\n");
- fprintf(output, " with a maximum of <seconds per file> each.\n");
- fprintf(output, " -F <capture type> set the output file type; default is pcapng.\n");
- fprintf(output, " an empty \"-F\" option will list the file types.\n");
- fprintf(output, " -T <encap type> set the output file encapsulation type;\n");
- fprintf(output, " default is the same as the input file.\n");
- fprintf(output, " an empty \"-T\" option will list the encapsulation types.\n");
- fprintf(output, "\n");
- fprintf(output, "Miscellaneous:\n");
- fprintf(output, " -h display this help and exit.\n");
- fprintf(output, " -v verbose output.\n");
- fprintf(output, " If -v is used with any of the 'Duplicate Packet\n");
- fprintf(output, " Removal' options (-d, -D or -w) then Packet lengths\n");
- fprintf(output, " and MD5 hashes are printed to standard-out.\n");
- fprintf(output, "\n");
+ fprintf(output, "\n");
+ fprintf(output, "Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]\n");
+ fprintf(output, "\n");
+ fprintf(output, "<infile> and <outfile> must both be present.\n");
+ fprintf(output, "A single packet or a range of packets can be selected.\n");
+ fprintf(output, "\n");
+ fprintf(output, "Packet selection:\n");
+ fprintf(output, " -r keep the selected packets; default is to delete them.\n");
+ fprintf(output, " -A <start time> only output packets whose timestamp is after (or equal\n");
+ fprintf(output, " to) the given time (format as YYYY-MM-DD hh:mm:ss).\n");
+ fprintf(output, " -B <stop time> only output packets whose timestamp is before the\n");
+ fprintf(output, " given time (format as YYYY-MM-DD hh:mm:ss).\n");
+ fprintf(output, "\n");
+ fprintf(output, "Duplicate packet removal:\n");
+ fprintf(output, " --novlan remove vlan info from packets before checking for duplicates.\n");
+ fprintf(output, " -d remove packet if duplicate (window == %d).\n", DEFAULT_DUP_DEPTH);
+ fprintf(output, " -D <dup window> remove packet if duplicate; configurable <dup window>\n");
+ fprintf(output, " Valid <dup window> values are 0 to %d.\n", MAX_DUP_DEPTH);
+ fprintf(output, " NOTE: A <dup window> of 0 with -v (verbose option) is\n");
+ fprintf(output, " useful to print MD5 hashes.\n");
+ fprintf(output, " -w <dup time window> remove packet if duplicate packet is found EQUAL TO OR\n");
+ fprintf(output, " LESS THAN <dup time window> prior to current packet.\n");
+ fprintf(output, " A <dup time window> is specified in relative seconds\n");
+ fprintf(output, " (e.g. 0.000001).\n");
+ fprintf(output, " -a <framenum>:<comment> Add or replace comment for given frame number\n");
+ fprintf(output, "\n");
+ fprintf(output, " -I <bytes to ignore> ignore the specified bytes at the beginning of\n");
+ fprintf(output, " the frame during MD5 hash calculation\n");
+ fprintf(output, " Useful to remove duplicated packets taken on\n");
+ fprintf(output, " several routers(differents mac addresses for \n");
+ fprintf(output, " example)\n");
+ fprintf(output, " e.g. -I 26 in case of Ether/IP/ will ignore \n");
+ fprintf(output, " ether(14) and IP header(20 - 4(src ip) - 4(dst ip)).\n");
+ fprintf(output, "\n");
+ fprintf(output, " NOTE: The use of the 'Duplicate packet removal' options with\n");
+ fprintf(output, " other editcap options except -v may not always work as expected.\n");
+ fprintf(output, " Specifically the -r, -t or -S options will very likely NOT have the\n");
+ fprintf(output, " desired effect if combined with the -d, -D or -w.\n");
+ fprintf(output, "\n");
+ fprintf(output, "Packet manipulation:\n");
+ fprintf(output, " -s <snaplen> truncate each packet to max. <snaplen> bytes of data.\n");
+ fprintf(output, " -C [offset:]<choplen> chop each packet by <choplen> bytes. Positive values\n");
+ fprintf(output, " chop at the packet beginning, negative values at the\n");
+ fprintf(output, " packet end. If an optional offset precedes the length,\n");
+ fprintf(output, " then the bytes chopped will be offset from that value.\n");
+ fprintf(output, " Positive offsets are from the packet beginning,\n");
+ fprintf(output, " negative offsets are from the packet end. You can use\n");
+ fprintf(output, " this option more than once, allowing up to 2 chopping\n");
+ fprintf(output, " regions within a packet provided that at least 1\n");
+ fprintf(output, " choplen is positive and at least 1 is negative.\n");
+ fprintf(output, " -L adjust the frame (i.e. reported) length when chopping\n");
+ fprintf(output, " and/or snapping\n");
+ fprintf(output, " -t <time adjustment> adjust the timestamp of each packet;\n");
+ fprintf(output, " <time adjustment> is in relative seconds (e.g. -0.5).\n");
+ fprintf(output, " -S <strict adjustment> adjust timestamp of packets if necessary to insure\n");
+ fprintf(output, " strict chronological increasing order. The <strict\n");
+ fprintf(output, " adjustment> is specified in relative seconds with\n");
+ fprintf(output, " values of 0 or 0.000001 being the most reasonable.\n");
+ fprintf(output, " A negative adjustment value will modify timestamps so\n");
+ fprintf(output, " that each packet's delta time is the absolute value\n");
+ fprintf(output, " of the adjustment specified. A value of -0 will set\n");
+ fprintf(output, " all packets to the timestamp of the first packet.\n");
+ fprintf(output, " -E <error probability> set the probability (between 0.0 and 1.0 incl.) that\n");
+ fprintf(output, " a particular packet byte will be randomly changed.\n");
+ fprintf(output, " -o <change offset> When used in conjunction with -E, skip some bytes from the\n");
+ fprintf(output, " beginning of the packet. This allows one to preserve some\n");
+ fprintf(output, " bytes, in order to have some headers untouched.\n");
+ fprintf(output, "\n");
+ fprintf(output, "Output File(s):\n");
+ fprintf(output, " -c <packets per file> split the packet output to different files based on\n");
+ fprintf(output, " uniform packet counts with a maximum of\n");
+ fprintf(output, " <packets per file> each.\n");
+ fprintf(output, " -i <seconds per file> split the packet output to different files based on\n");
+ fprintf(output, " uniform time intervals with a maximum of\n");
+ fprintf(output, " <seconds per file> each.\n");
+ fprintf(output, " -F <capture type> set the output file type; default is pcapng. An empty\n");
+ fprintf(output, " \"-F\" option will list the file types.\n");
+ fprintf(output, " -T <encap type> set the output file encapsulation type; default is the\n");
+ fprintf(output, " same as the input file. An empty \"-T\" option will\n");
+ fprintf(output, " list the encapsulation types.\n");
+ fprintf(output, "\n");
+ fprintf(output, "Miscellaneous:\n");
+ fprintf(output, " -h display this help and exit.\n");
+ fprintf(output, " -v verbose output.\n");
+ fprintf(output, " If -v is used with any of the 'Duplicate Packet\n");
+ fprintf(output, " Removal' options (-d, -D or -w) then Packet lengths\n");
+ fprintf(output, " and MD5 hashes are printed to standard-error.\n");
+ fprintf(output, "\n");