S<[ B<-C> E<lt>choplenE<gt> ]>
S<[ B<-E> E<lt>error probabilityE<gt> ]>
S<[ B<-F> E<lt>file formatE<gt> ]>
+S<[ B<-W> E<lt>file format optionE<gt>]>
+S<[ B<-H> E<lt>input hosts file<gt> ]>
S<[ B<-A> E<lt>start timeE<gt> ]>
S<[ B<-B> E<lt>stop timeE<gt> ]>
S<[ B<-h> ]>
=item -C E<lt>choplenE<gt>
-Sets the chop length to use when writing the packet data.
-Each packet is chopped at the packet end by a few <choplen> bytes of data.
+Sets the chop length to use when writing the packet data. Each packet is
+chopped by a few <choplen> bytes of data. Positive values chop at the packet
+beginning while negative values chop at the packet end.
-This is useful in the rare case that the conversion between two file
-formats leaves some random bytes at the end of each packet.
+This is useful for chopping headers for decapsulation of an entire capture or
+in the rare case that the conversion between two file formats leaves some random
+bytes at the end of each packet.
=item -d
can be useful in scripts to identify duplicate packets across trace
files.
-The <dup window> is specifed as an integer value between 0 and 1000000 (inclusive).
+The <dup window> is specified as an integer value between 0 and 1000000 (inclusive).
NOTE: Specifying large <dup window> values with large tracefiles can
result in very long processing times for B<editcap>.
the packet to skipped. The duplicate comparison test stops when
the current packet's relative arrival time is greater than <dup time window>.
-The <dup time window> is specifed as I<seconds>[I<.fractional seconds>].
+The <dup time window> is specified as I<seconds>[I<.fractional seconds>].
The [.fractional seconds] component can be specified to nine (9) decimal
places (billionths of a second) but most typical trace files have resolution
=item -E E<lt>error probabilityE<gt>
-Sets the probabilty that bytes in the output file are randomly changed.
+Sets the probability that bytes in the output file are randomly changed.
B<Editcap> uses that probability (between 0.0 and 1.0 inclusive)
to apply errors to each data byte in the file. For instance, a
probability of 0.02 means that each byte has a 2% chance of having an error.
provides a list of the available output formats. The default
is the B<libpcap> format.
+=item -W E<lt>file format optionE<gt>
+
+Save extra information in the file if the format supports it. For
+example,
+
+ -F pcapng -W n
+
+will save host name resolution records along with captured packets.
+
+Future versions of Wireshark may automatically change the capture format to
+B<pcapng> as needed.
+
+The argument is a string that may contain the following letter:
+
+B<n> write network address resolution information (pcapng only)
+
+=item -H E<lt>input "hosts" fileE<gt>
+
+Read a list of address to host name mappings and include the result in
+the output file. Implies B<-W n>.
+
+The input file format is described at
+L<http://en.wikipedia.org/wiki/Hosts_%28file%29>.
+
=item -A E<lt>start timeE<gt>
Saves only the packets whose timestamp is on or after start time.
=item -B E<lt>stop timeE<gt>
-Saves only the packets whose timestamp is on or before stop time.
+Saves only the packets whose timestamp is before stop time.
The time is given in the following format YYYY-MM-DD HH:MM:SS
=item -h