#37 Unable to split pcap file

[Ivan]

Hello.

I'm failing to use option "-r" as pcapsipdump returns "no VLAN support for data link type 113" when I ommit option "-i" and nothing when specify it. You may find examples of printsout attached.
I have used "pcapsipdump-code-r146-trunk.zip" to compile and install the app on Ubuntu 18.04.3 LTS. Also, same behaviour I can observ on CentOS Linux release 7.6.1810 (Core) but with different version.

Am I doing something wrong trying to read a file or is there any issue?

[Aex Aey]

Thanks for reporting.

According to /usr/include/pcap/dlt.h link type 113 is "Linux cooked sockets".

This interface type (lo, tun, etc...) lack L2 header, and therefore vlan support. Vlan was, until now, part of default pcap filter expression.

This should be fixed in [r147] (by dropping default pcap filter expression altogether).

For earlier version, any explicit pcap expression compatible with linktype can be specified after all the other parameters, for example ip. This will override default pcap filter expression.

[Ivan]

Hello.

Thank you for explanations. Now I can split the file.
Also, I was suprised that it is possible to set filetrs like TCP/UDP port.

Thank you.