ditl-fix-pcap-header-len-caplen

Quick hack to fix len and caplen in pcap_pkthdr for PCAPs generated by tcpdump with the bug libpcap version 1.5.3 causes the creation of invalid pcap files with packet length < capture length when capturing on the "any" interface.

The fix is to set caplen to len if caplen is larger then len.

Build

sh autogen.sh
./configure
make
make install

Usage

cat file.pcap | ditl-fix-pcap-header-len-caplen > fixed.pcap

You can pipeline compression also:

gzip -cd file.pcap.gz | ditl-fix-pcap-header-len-caplen | gzip > fixed.pcap.gz