Skip to content

Instantly share code, notes, and snippets.

@svinz
Last active November 7, 2022 16:13
Show Gist options
  • Save svinz/61186d71f315ab192231900359624e1a to your computer and use it in GitHub Desktop.
Save svinz/61186d71f315ab192231900359624e1a to your computer and use it in GitHub Desktop.
Remove the Cohda header from a pcap

Remove the Cohda header from a pcap recorded by a Cohda ITS-G5 radio

This gist describe how to remove the Cohda header from a .pcap file recorded in a Cohda ITS-G5 radio. This header does contain some information about the radiosignals. But if not interessted in them, it is possible to just remove them.

Pre-requisites

Linux/WSL etc

On a WSL/Linux of some kind, install wireshark-common:

sudo apt-get update
sudo apt-get install wireshark-common

Windows

If you have installed Wireshark on a Windows computer, editcap is already installed in the Wireshark directory

Edit the file with editcap

After this is installed, use editcap to manipulate the pcap file:

editcap -T ether -C 32 rx.pcap rx2.pcap

The -T ether specifies that the starting protocol is ethernet. The -C 32 cuts of the first 32 bytes (which by incident is the amount of bytes that Cohda adds first)

In case you want to use Windows, it is much the same:

cd "C:\Program Files\Wireshark"
editcap.exe -T ether -C 32 rx.pcap rx2.pcap
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment