Anyone use PCAP/TAP?

[dsullinger]

Has anyone here used pcap/tap? If so, have you had any luck getting this into another sniffer to view the results? If so, which one?

 

[V11]

I open them in Netmon ver. 2 or Ethereal (the Pcap file is saved with a .cap extension. Of the two, I prefer Netmon.

 

[dsullinger]

Do you convert the file first before downloading? Where can I find netmon?

 

[dsullinger]

V11: If you could please help me with this, here's what I'm doing:

1. I use pcap to capture the data
2. Open the capture with tap
3. Save the data out as a PCAP file as test.cap
4. Open the latest version of Ethereal and try to open the file
5. I get a message that says "Ethereal can not understand the file format"

Are you doing something different?

 

[V11]

Netmon is Microsoft's Network Monitor. I believe it comes with the advanced server software or you have to buy Microsofts SMS.

That said, I leave TAP at the default when I save the file ---default is Network General Sniffer. My Ethereal is version 0.9.2(C) My PCAP/TAP is Walts ver 3.00.

How big is the file?

I hope this helps.

 

[dsullinger]

We are running version 2.10 and this could be the problem. I will have to contact Nortel about getting a newer version. I checked our Optivity v10 CD and it included PCAP/TAP, but it still was version 2.10.

We have Netmon, I will just have to run it down. Thanks.