blocks|key|1349040|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1349041|+pcap-ng和pcap有什么区别？|blockquote|1349042|1349043|1349044|pcap比pcap-ng更老，功能更弱，但更简单。这是a+description+of+pcap+file+format；这是a+description+of+pcap-ng+file+format。|offset|length|1349045|1349046|有没有用于pcap-ng的工具/库？|1349047|1349048|1349049|较新版本的libpcap可以读取一些pcap-ng文件(所有接口都需要具有相同的链路层头部类型和快照长度，因为libpcap+API只能为一个文件提供一种链路层头部类型和一种快照长度)。Wireshark包含一个可以读写多种捕获文件格式的库，包括pcap和pcap-ng，但它没有一个稳定的或有良好文档记录的API+(它将在下一个Wireshark主版本中进行重大更改，以更好地支持pcap-ng和其他格式)。|1349050|1349051|如何将pcap转换为pcap-ng和pcap-ng转换为pcap？|1349052|1349053|1349054|使用Wireshark附带的"editcap“工具。请注意，并不是所有的pcap-ng文件都可以转换为pcap文件-只有可以由libpcap读取的文件才可以转换(如果tcpdump使用的是能够读取pcap-ng文件的较新版本的libpcap，则这些文件也可以通过tcpdump从pcap-ng转换为pcap+)。|1349055|entityMap|0|LINK|mutability|MUTABLE|url|http://www.tcpdump.org/manpages/pcap-savefile.5.html|1|http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html^0|0|0|0|0|R|X|0|1R|10|1|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|-4|4|5|6|17|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|18|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|19|7|@]|8|@]|9|$]]|$1|E|3|-4|4|5|6|1A|7|@]|8|@]|9|$]]|$1|F|3|G|4|5|6|1B|7|@]|8|@$H|1C|I|1D|1|1E]|$H|1F|I|1G|1|1H]]|9|$]]|$1|J|3|-4|4|5|6|1I|7|@]|8|@]|9|$]]|$1|K|3|L|4|C|6|1J|7|@]|8|@]|9|$]]|$1|M|3|-4|4|5|6|1K|7|@]|8|@]|9|$]]|$1|N|3|-4|4|5|6|1L|7|@]|8|@]|9|$]]|$1|O|3|P|4|5|6|1M|7|@]|8|@]|9|$]]|$1|Q|3|-4|4|5|6|1N|7|@]|8|@]|9|$]]|$1|R|3|S|4|C|6|1O|7|@]|8|@]|9|$]]|$1|T|3|-4|4|5|6|1P|7|@]|8|@]|9|$]]|$1|U|3|-4|4|5|6|1Q|7|@]|8|@]|9|$]]|$1|V|3|W|4|5|6|1R|7|@]|8|@]|9|$]]|$1|X|3|-4|4|5|6|1S|7|@]|8|@]|9|$]]]|Y|$Z|$4|10|11|12|9|$13|14]]|15|$4|10|11|12|9|$13|16]]]]

<blockquote>
 What is the difference between pcap-ng and pcap?
</blockquote>

pcap is older and less capable than pcap-ng, but is simpler. Here's <a href="http://www.tcpdump.org/manpages/pcap-savefile.5.html" rel="noreferrer">a description of pcap file format</a>; here's <a href="http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html" rel="noreferrer">a description of pcap-ng file format</a>.

<blockquote>
 Is there any tool/library for pcap-ng?
</blockquote>

Newer versions of libpcap can read some pcap-ng files (all interfaces need to have the same link-layer header type and snapshot length, as the libpcap API can supply only one link-layer header type and only one snapshot length for a file). Wireshark includes a library that can read and write a number of capture file formats, including pcap and pcap-ng, but it doesn't have a stable or well-documented API (it'll be changed quite significantly in the next Wireshark major release to better support pcap-ng and other formats).

<blockquote>
 How to convert pcap to pcap-ng and pcap-ng to pcap?
</blockquote>

Use the "editcap" tool that comes with Wireshark. Note that not all pcap-ng files can be converted to pcap files - only the files that could be read by libpcap can be converted (and those can also be converted from pcap-ng to pcap by tcpdump, if tcpdump is using a newer version of libpcap capable of reading pcap-ng files).

blocks|key|2406916|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2406917|如何将pcap转换为pcap-ng和pcap-ng转换为pcap？|blockquote|2406918|2406919|2406920|Linux/Wireshark简易解释|offset|length|style|BOLD|2406921|Guy+Harris回答得很好，但我将重点放在最后一个问题上，因为我想很多人(像我)都通过了，并将在这里寻找关于将pcapng转换为pcap+(反之亦然)的简单解释。正如Guy提到的，并不是所有的pcap-ng文件都可以转换为pcap文件，因为editcap可能无法工作，所以不要将包保存为pcapng格式而是libcap格式。|2406922|​|2406923|2406924|+pcapng+->+pcap|2406925|2406926|2406927|将捕获的数据包保存为libcap格式(example+-+link指的是windows-sample，但在Linux中是一样的)|2406928|在感兴趣的路径中打开一个shell，并按以下方式使用tcpdump|2406929|tcpdump+-r+file_to_convert+-w+file_converted|2406930|(如果您没有安装tcpdump，只需使用"apt-get+install+tcpdump“安装它，或者如果您有不同的Linux发行版，请搜索google+)|2406931|2406932|2406933|+pcap+->+pcapng|2406934|2406935|2406936|使用Wireshark打开pcap文件，并将其保存为pcapng格式。您已经完成了转换。|2406937|希望这能帮到我，因为它对我有帮助。|2406938|entityMap|0|LINK|mutability|MUTABLE|url|http://www.wireshark.org/docs/wsug_html_chunked/wsug_graphics/xws-save-as-win32.png.pagespeed.ic._cilg8Qtxq.png^0|0|0|0|0|0|J|0|0|0|0|0|0|0|J|7|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|-4|4|5|6|1K|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|1L|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|1M|7|@]|8|@]|9|$]]|$1|E|3|-4|4|5|6|1N|7|@]|8|@]|9|$]]|$1|F|3|G|4|5|6|1O|7|@$H|1P|I|1Q|J|K]]|8|@]|9|$]]|$1|L|3|M|4|5|6|1R|7|@]|8|@]|9|$]]|$1|N|3|O|4|5|6|1S|7|@]|8|@]|9|$]]|$1|P|3|-4|4|5|6|1T|7|@]|8|@]|9|$]]|$1|Q|3|R|4|C|6|1U|7|@]|8|@]|9|$]]|$1|S|3|-4|4|5|6|1V|7|@]|8|@]|9|$]]|$1|T|3|-4|4|5|6|1W|7|@]|8|@]|9|$]]|$1|U|3|V|4|5|6|1X|7|@]|8|@$H|1Y|I|1Z|1|20]]|9|$]]|$1|W|3|X|4|5|6|21|7|@]|8|@]|9|$]]|$1|Y|3|Z|4|5|6|22|7|@]|8|@]|9|$]]|$1|10|3|11|4|5|6|23|7|@]|8|@]|9|$]]|$1|12|3|O|4|5|6|24|7|@]|8|@]|9|$]]|$1|13|3|-4|4|5|6|25|7|@]|8|@]|9|$]]|$1|14|3|15|4|C|6|26|7|@]|8|@]|9|$]]|$1|16|3|-4|4|5|6|27|7|@]|8|@]|9|$]]|$1|17|3|-4|4|5|6|28|7|@]|8|@]|9|$]]|$1|18|3|19|4|5|6|29|7|@]|8|@]|9|$]]|$1|1A|3|1B|4|5|6|2A|7|@]|8|@]|9|$]]|$1|1C|3|-4|4|5|6|2B|7|@]|8|@]|9|$]]]|1D|$1E|$4|1F|1G|1H|9|$1I|1J]]]]

<blockquote>
How to convert pcap to pcap-ng and pcap-ng to pcap?
</blockquote>
[Linux/Wireshark Easy Explanation]
Guy Harris answered very well, but I will focus on the last question as I suppose that many (like me) are passed and will pass here in search of a simple explanation about convert pcapng to pcap (and viceversa).
As Guy mentioned, not all pcap-ng files can be converted to pcap files because editcap may not work, so just don't save your packets in pcapng format but in libcap.
 
<blockquote>
pcapng -&gt; pcap
</blockquote>
Save your captured packets in libcap format (<a href="http://www.wireshark.org/docs/wsug_html_chunked/wsug_graphics/xws-save-as-win32.png.pagespeed.ic._cilg8Qtxq.png" rel="nofollow noreferrer">example</a> - link refers to windows-sample but its the same in Linux)
Open a shell in the path of interest and use tcpdump in the following way 
tcpdump -r file_to_convert -w file_converted 
(if you dont have tcpdump installed, just install it with &quot;apt-get install tcpdump&quot; or search google if you have a different Linux distribution) 
 
<blockquote>
pcap -&gt; pcapng
</blockquote>
Open your pcap file with Wireshark and save it in pcapng format. You have done you conversion. 
Hope this can help as it helped me.

blocks|key|5927107|text|在PcapNG.com上，有一些关于使用PCAP-NG与普通老式PCAP相比的优点和缺点的好信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5927108|这两种格式之间的主要区别在于，PCAP-NG允许多种接口类型和注释(即注释)。PCAP-NG还可以存储名称解析块(即缓存的主机名/+DNS条目)，这是一个有用的功能，但也是一个隐私问题。|5927109|此外，PcapNG.com还具有在线转换功能，允许您将任何PCAP-NG文件转换回PCAP格式。|5927110|entityMap|0|LINK|mutability|MUTABLE|url|http://pcapng.com/^0|1|A|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

There is some good information about the benefits and drawbacks of using PCAP-NG compared to plain old PCAP over at <a href="http://pcapng.com" rel="nofollow">PcapNG.com</a>.

The main difference between the two formats is that PCAP-NG allows for multiple interface types and annotations (i.e. comments). PCAP-NG can also store name resolution blocks (i.e. cached hostname / DNS entries), which is a useful feature but also a privacy issue.

PcapNG.com additionally has an online conversion feature, which lets you convert any PCAP-NG file back to the PCAP format.

I'm looking for some information about pcap-ng. 

What is the difference between pcap-ng and pcap? 

Is there any tool/library for pcap-ng? 

How to convert pcap to pcap-ng and pcap-ng to pcap?

Convert pcap <-> pcap-ng, pcap-ng tools/libraries

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我在找一些关于pcap-ng的信息。pcap-ng和pcap有什么区别？有没有用于pcap-ng的工具/库？如何将pcap转换为pcap-ng，将pcap-ng转换为pcap？

问转换pcap <-> pcap-ng，pcap-ng工具/库
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问转换pcap <-> pcap-ng，pcap-ng工具/库EN