viewcap

README

viewcap

A tool for viewing timestamp, layer2 and layer3 addresses from a PCAP file. You can specify a head count (number of packets from the start of the file) and you can also specify a MAC address to search for. PCAP-ng files are not currently supported. This tool will accommodate 802.1Q tagged frames and Q-in-Q double tagged frames.

I wrote this using Go (golang) v1.5

For command line flags run, ./viewcap --help

Binary Releases

I have produced binaries for Mac OSX 10.10.5 and Ubuntu Linux 14.04 64bit (but should work on any 64bit Linux), please look in the releases section for the zip files

Installation From Source##

go/src/> go get github.com/jordan2175/viewcap
go/src/> go install github.com/jordan2175/viewcap/
go/src/> cd github.com/jordan2175/viewcap
go/src/github.com/jordan2175/viewcap/> go build -o viewcap *.go

Usage

See GoDoc for documentation and examples.

Examples

./rewritecap --help
./viewcap -f test.pcap
./viewcap -f test.pcap --mac 68:A8:6D:18:36:92
./viewcap -f test.pcap --head=10

Contributing

Contributions welcome! Please fork the repository and open a pull request with your changes or send me a diff patch file.

License

This is free software, licensed under the Apache License, Version 2.0.