Re: AW: [Ethereal-users] New User - How do I cpature/save Cisco Debug s For Analysis

["M.C. van den Bovenkamp" <marco@xxxxxxxxxxxxxxxxxxx>]

Schlabach, Torsten wrote:

> Did you ever try this in practice?

Yes, I did.

> I just cannot make it work.
> What parameters to text2pcap do you use?

The problem is probably that this script as it stands only works when 
the input & output interface are both Ethernet of some sort.

If that's the case, doing a 'conv_cisco.pl < dumpfile.name | text2pcap - 
output.cap' works. No special options.

If the output interface is serial (and perhaps others) the output of 
'debug ip packet dump' is only the IP packet, and something like 
'text2pcap -l 12' or playing with '-e' works.

The dump format isn't consistent, alas.

--

		Regards,

			Marco.