editcap -A and -B: using timestamp with nanoseconds example

Question

I'm trying to get editcap to use a timestamp with nanoseconds, but I am unable to do this.

sample timestamp: 2022-01-23 23:10:05.237000000Z

TZ=UTC editcap -A '2022-01-23 23:10:05.237000000Z' -F nseclibpcap <some pcap file> <new trimmed pcap file>

This appears to only go the second rather than the nano second.

Does anyone have a sample cmd line on how they went about using nanoseconds?

Answer 1

At least one of your command-line options to editcap is incorrect. If you run editcap -F as suggested in the man page, you'll see that nseclibpcap is not a valid output capture file format. Try running the command again, but this time with a valid output capture file format specified, for example:

TZ=UTC editcap -A '2022-01-23 23:10:05.237000000Z' -F pcap infile.pcap outfile.pcap