dagconvert(1)

NAME
dagconvert - Endace file conversion utility

SYNOPSIS
dagconvert [options]

DESCRIPTION
dagconvert is a utility for converting data to various file formats. Supported formats are:

    dag Read ERF records directly from DAG card (input only).

    erf ERF (Extensible Record Format) file (input and output).

    atm Legacy ATM file (input only).

    eth Legacy Ethernet file (input only).

    pos Legacy PoS file (input only).

    null
        Produces no input or output.

    pcap
        pcap(3) format file (input or output).

    prt ASCII text packet dump (output only).

Data can be input from a file or captured from a DAG card.

dagconvert can be used for converting data captured from a DAG card to pcap(3) format. This allows the trace file to be used with tools that support the pcap(3) file format. Also the reverse is possible, where data can be converted to ERF format for use in other dag utilities.

OPTIONS

-A NUM
    Set the record alignment of the ERF to NUM bytes (ERF only).

-b EXPRESSION
    Specify a tcpdump(1) style BPF expression to be applied to the packets.

-c 0|16|32
    Specify the size (in bits) of the frame checksum (FCS) (pcap(3) only).

-d DEVICE

--device DEVICE
    Use the DAG device referred to by DEVICE. Supported syntax includes 0, dag1, and /dev/dag3 to refer to DAG cards, and 0:2, dag1:1, and /dev/dag2:0 to refer to specific streams on cards.

-f FILTERS
    A comma-delimited list of filters to be applied to the data. Supported filters are:

    rx  Filter out rx errors (link layer).

    ds  Filter out ds errors (framing).

    trunc
        Filter out truncated packets.

    a,b,c,d
        Filter on indicated interface(s).

-F  Select fixed length output (ERF only).

-G NUM
    Set the GMT offset to NUM seconds (pcap(3) only).

-h

-?

--help

--usage
    Display usage (help) information.

-i FILES
    Name(s) of the input file(s). If more than one filename is given, the ERF records from the files will be merged in timestamp order to the output.

-o FILE
    Name of the output file.

-r NUM
    Rotate the output file after NUM bytes. Add k, m, and g suffixes for kibibytes, mebibytes and gibibytes.

-s NUM
    Set the snap length to NUM bytes.

-t NUM
    Capture from the DAG card for NUM seconds.

-T atm|dag|erf|eth|pcap|pos : erf|pcap|prt
    Input and output types. See the DESCRIPTION section above for more information about the input and output types.

-v

--verbose
    Increase output verbosity.

-V  Select variable length output (ERF only).

--version
    Display version information.

-y DLT
    Use the pcap(3) DLT when applying BPF filters (-b) and when outputting to pcap(3) format. Available Data Link Types (case insensitive) are:

    EN10MB
        Ethernet

    DOCSIS
        Ethernet

    CHDLC
        HDLC

    PPP_SERIAL
        HDLC

    FRELAY
        HDLC

    MTP2
        HDLC

    ATM_RFC1483
        ATM, AAL5

    SUNATM
        ATM, AAL5

EXAMPLES
To read from DAG card 0 and save to a file in ERF format:
    dagconvert -d 0 -T dag:erf -o outfile.erf

To read from DAG card 1 and save to a file in pcap(3) format:
    dagconvert -d 1 -T dag:pcap -o outfile.pcap

To convert a file from ERF format to pcap(3) format:
    dagconvert -T erf:pcap -i infile.erf -o outfile.pcap

To convert an HDLC trace file containing MTP2 SS7 frames from ERF format to pcap(3) DLT_MTP2 format:
    dagconvert -T erf:pcap -i infile.erf -o outfile.pcap -y mtp2

To convert an Ethernet trace file from ERF format to pcap(3) format, outputting only packets to or from ip address 192.168.1.59:
    dagconvert -T erf:pcap -i infile.erf -o outfile.pcap -b 'host 192.168.1.59'

To filter an ERF Format ATM trace file outputting only cells/packets with VPI 10 VCI 512 without changing the output format:
    dagconvert -i infile.erf -o outfile.erf -y sunatm -b 'vpi 10 and vci 512'

To convert a file from pcap(3) format to ERF format, ensuring the ERF records are 64-bit aligned (and therefore suitable for transmission using dagflood(1)):
    dagconvert -T pcap:erf -A 8 -i infile.pcap -o outfile64.erf

SEE ALSO
dagflood(1), pcap(3), tcpdump(1).

BUGS
Report bugs to <support@endace.com>.

LAST UPDATED
$Author: sfd $
$Revision: 6917 $
$Date: 2007-05-31 13:18:51 +1200 (Thu, 31 May 2007) $

COPYRIGHT
(c) 2004-2005 Endace Technology, Hamilton, New Zealand. All Rights Reserved.