text2pcap: Switch default file format to pcapng

For the upcoming 4.0 release, switch the default file format for
text2pcap to pcapng from pcap, to match other tools and the GUI
behavior. Update the documentation and release notes appropriately.

Deprecate the old -n flag; since pcapng is the default this has no
effect. Changing the output capture file format is supported with
the -F option, consistent with the other command line tools.

Related to #18009.
This commit is contained in:
John Thacker 2022-05-11 22:13:42 -04:00 committed by Gerald Combs
parent b602911b31
commit 2e5a78dc64
4 changed files with 10 additions and 13 deletions

View File

@ -22,7 +22,6 @@ text2pcap - Generate a capture file from an ASCII hexdump of packets
[ *-h* ]
[ *-i* <proto> ]
[ *-l* <typenum> ]
[ *-n* ]
[ *-N* <intf-name> ]
[ *-m* <max-packet> ]
[ *-o* hex|oct|dec|none ]
@ -51,7 +50,7 @@ hexdumps of application-level data only.
*Text2pcap* can write the file in several output formats.
The *-F* flag can be used to specify the format in which to write the
capture file, *text2pcap -F* provides a list of the available output
formats. By default, it writes the packets to __outfile__ in the *pcap*
formats. By default, it writes the packets to __outfile__ in the *pcapng*
file format.
*Text2pcap* understands a hexdump of the form generated by __od -Ax
@ -231,7 +230,7 @@ to specify the encapsulation that matches the input data.
--
Sets the file format of the output capture file. *Text2pcap* can write
the file in several formats; *text2pcap -F* provides a list of the
available output formats. The default is the *pcap* format.
available output formats. The default is the *pcapng* format.
--
-h::
@ -274,9 +273,6 @@ will convert from plain datastream format to a sequence of Ethernet
TCP packets.
--
-n::
Write the file in pcapng format rather than pcap format.
-N <intf-name>::
Specify a name for the interface included when writing a pcapng format file.

View File

@ -85,6 +85,7 @@ The following features are new (or have been significantly updated) since versio
* The `text2pcap` command and the “Import from Hex Dump” feature have been updated and enhanced:
** `text2pcap` supports writing the output file in all the capture file formats that wiretap library supports, using the same `-F` option as `editcap`, `mergecap`, and `tshark`.
** Consistent with the other command line tools like `editcap`, `mergecap`, `tshark`, and the "Import from Hex Dump" option within Wireshark, the default capture file format for `text2pcap` is now *pcapng*. The `-n` flag to select pcapng (instead of the previous default, pcap) has been has been deprecated and will be removed in a future release.
** `text2pcap` supports selecting the encapsulation type of the output file format using the wiretap library short names with an `-E` option, similiar to the `-T` option of `editcap`.
** `text2pcap` has been updated to use the new logging output options and the `-d` flag has been removed.
The "debug" log level corresponds to the old `-d` flag, and the "noisy" log level corresponds to using `-d` multiple times.

View File

@ -212,11 +212,12 @@ $ mergecap -w outfile.pcapng dhcp-capture.pcapng imap-1.pcapng
=== __text2pcap__: Converting ASCII hexdumps to network captures
There may be some occasions when you wish to convert a hex dump of some network
traffic into a libpcap file.
traffic into a capture file.
`text2pcap` is a program that reads in an ASCII hex dump and writes the data
described into a pcap or pcapng capture file. `text2pcap` can read hexdumps with
multiple packets in them, and build a capture file of multiple packets.
described into any capture file format supported by libwiretap. `text2pcap` can
read hexdumps with multiple packets in them, and build a capture file of
multiple packets.
`text2pcap` is also capable of generating dummy Ethernet, IP, UDP, TCP or SCTP
headers, in order to build fully processable packet dumps from hexdumps of
application-level data only.

View File

@ -210,7 +210,7 @@ print_usage (FILE *output)
" (def: 16: hexadecimal) No effect in hexdump mode.\n"
"\n"
"Output:\n"
" -F <capture type> set the output file type; default is pcap.\n"
" -F <capture type> set the output file type; default is pcapng.\n"
" an empty \"-F\" option will list the file types.\n"
" -E <encap type> set the output file encapsulation type; default is\n"
" ether (Ethernet). An empty \"-E\" option will list\n"
@ -221,7 +221,6 @@ print_usage (FILE *output)
" numbers.\n"
" Example: -l 7 for ARCNet packets.\n"
" -m <max-packet> max packet length in output; default is %d\n"
" -n use pcapng instead of pcap as output format.\n"
" -N <intf-name> assign name to the interface in the pcapng file.\n"
"\n"
"Prepend dummy header:\n"
@ -395,7 +394,7 @@ parse_options(int argc, char *argv[], text_import_info_t * const info, wtap_dump
wtap_encap_type = wtap_pcap_encap_to_wtap_encap(pcap_link_type);
break;
case 'm': max_offset = (guint32)strtol(ws_optarg, NULL, 0); break;
case 'n': file_type_subtype = wtap_pcapng_file_type_subtype(); break;
case 'n': cmdarg_err("'-n' is deprecated; the output format already defaults to pcapng."); break;
case 'N': interface_name = ws_optarg; break;
case 'b':
{
@ -858,7 +857,7 @@ parse_options(int argc, char *argv[], text_import_info_t * const info, wtap_dump
params->encap = wtap_encap_type;
params->snaplen = max_offset;
if (file_type_subtype == WTAP_FILE_TYPE_SUBTYPE_UNKNOWN) {
file_type_subtype = wtap_pcap_file_type_subtype();
file_type_subtype = wtap_pcapng_file_type_subtype();
}
/* Request nanosecond precision. Most file formats only support one time
* precision and ignore this parameter (and the related options in the