ProConvert

Welcome to ProConvert, WildPackets' packet file conversion utility. The program converts trace files from the format of one network protocol analyzer to that of another, or to generic formats such as tcpdump or ASCII text. Over two dozen different protocol analyzers and probes are supported, allowing you to convert from one vendor's format to another whenever you need to view a trace file in a different format. Wireless, Ethernet, Token Ring, FDDI, and WAN topologies are supported in a single program.

With ProConvert you can:

Share trace files with other protocol analyzer users.

Convert and send files to tech support for any analyzer.

Convert trace files for training purposes.

Convert from the Sniffer compressed format to other analyzers.

Reduce file size by converting to the same format using the frame slicing option.

Convert between 802.11Wireless LAN traces and 802.3 Ethernet format

Convert between Wide Area Network traces

This manual describes how to use ProConvert from the graphical user interface or the command line, and lists the file types it can convert. It also provides notes on special considerations in converting particular types of files and kinds of packet data.

WildPackets, Inc.
http://www.wildpackets.com
Voice: (800) 466-2447
Fax: (925) 937-2479
sales@wildpackets.com


Basic Operation

The ProConvert window is divided into three sections: Source File, Destination, and Options. The Format drop-down list includes all of the LAN analyzers whose formats can be converted by ProConvert. By default, this list contains only Ethernet analyzers the first time that you open ProConvert; afterward, this list will contain either wireless LAN analyzers or Ethernet analyzers, depending on which was selected for the Destination file the last time ProConvert was opened.

Figure 1.1 The ProConvert window


Using ProConvert

ProConvert can be started in any one of several ways. You can choose ProConvert from the Start > Programs menu to open the program without specifying the file to be converted. Alternatively, you can open ProConvert with a particular file ready to be converted, either by dragging a supported trace file over the ProConvert application icon or shortcut icon, or by right clicking on a trace file and selecting Send To > ProConvert from the context menu. In either case, ProConvert will start up with the specified trace file already entered in the Source File edit box.

Note: ProConvert can also be started from a DOS command prompt. This can be handy for creating a batch file to convert multiple files. For details, please see "Command line operation".

To convert a trace file from one analyzer file format to another, follow these steps:

  1. Start ProConvert.
  2. If you have not already done so, enter the path and file name of the trace file to be converted in the Source File edit box. You can browse for the file by choosing Open from the File menu or by clicking the open file folder icon to the right of the Source File edit box. When you select a file, ProConvert will display any information it contains about the Analyzer used to capture the trace, the type of Interface on which it was captured, the date and time of the capture in File Date, the File Size, and any Comment embedded in the trace file.

Note: Each analyzer is identified by the file format in ProConvert. Therefore, for example, if an *.enc file was created by an analyzer other than Sniffer, Analyzer will still show as Sniffer in the area directly below Source File. Likewise, LinkView source files will show as Domino, and all Finisar/Shomiti Surveyor OEMs such as the Acterna FireBerd PC, Agilient LAN Analyzer, or Fluke Protocol Inspector, will show as Surveyor.

Figure 1.2 ProConvert file format conversion

  3. Choose a supported analyzer file format for the Destination file in the Format drop down list.
  4. If necessary, name the new file to be created. By default, ProConvert automatically generates the same path and file name for the new file and appends a different file extension corresponding to the Destination file Format you selected in step 3. If the destination file has the same extension as the source file (.cap is a popular extension, for instance), you will need to rename the destination file. The destination file cannot have the exact same path and file name as the source file.
  5. In the Options section, use the radio buttons to choose to convert All packets or a Range of packets. Use the from and to data entry boxes to specify which frames to convert. For example, enter from 1 to 5,000 to convert the first 5,000 frames. Note that range values are inclusive. To convert a single packet, choose a Range such as from 5 to 5 to convert only the fifth packet in the file.
  6. To convert only the first portion of each packet and discard the rest, check the Slice to check box in the Options section and, in the data entry box, enter the number of Bytes to keep. Packet slicing counts from the beginning of the packet the number of Bytes you specify, converts that portion of the packet, and discards the rest. Header information is located at the beginning of the packet. Data (such as a part of a web page) is carried further back in the packet. Setting an appropriate slice value will convert only the packet headers of interest without converting the data contained in the body of the packet. Slicing can substantially reduce the size of the destination file.


Setting up wireless conversions

When you wish to convert an Ethernet trace file into an 802.11WLAN trace, enter the path and file name of your Source File as described above and check the checkbox labeled Convert to Wireless to the right of the Format drop-down list in the Destination section. The choices in the Format drop-down list will now list only wireless LAN analyzers, from which you can make your selection.

Figure 1.3 ProConvert window showing Convert to Wireless checkbox

When you choose an 802.11WLAN trace as your Source File, the checkbox to the right of the Format drop-down list in the Destination section changes from Convert to Wireless to Convert to Ethernet. Check this checkbox to convert the selected file to an Ethernet equivalent.

Figure 1.4 ProConvert window showing Convert to Ethernet checkbox

Note: When you check the Convert to Wireless or the Convert to Ethernet checkbox, ProConvert includes the old Source File suffix as a part of the new Destination file name, replacing . (the dot or period) with _ (an underscore).


Multiple file conversion

ProConvert will convert more than one trace file simultaneously to a different file type. These files to be converted must all be of the same type. Select the files you wish to convert, drag them onto ProConvert, and they will be converted to the new file type. Alternatively, select multiple files in the open file dialog for conversion to the new file type.


Command line operation

ProConvert for Windows can be run by calling it from a DOS command prompt, as long as Windows itself is running. (In other words, you cannot run ProConvert for Windows if you boot the computer in DOS without loading Windows.) You can also pass command line parameters in a Windows shortcut icon, by using the shortcut's properties settings. This can be very useful when you do one particular type of conversion frequently.

The command line syntax is:

PROCONVERT FILENAME.EXT TA

Where the FILENAME.EXT term is the source trace file you wish to convert, and the TA term is the two-letter code for the target analyzer or destination file type. For a list of supported analyzer file types and their TA codes, see "Supported file formats", and check the TA Code column of Table 1.1.

Note: Command line operation offers only a direct conversion, without any options and without the ability to alter the default output file name or path. The converted file will be placed in the same directory as the source file, and will have the same name with the new file extension.

For specific information on how ProConvert converts trace files, see "Technical notes".


Supported file formats

ProConvert supports conversion of trace files from the analyzers and probes shown in Table 1.1. Conversions are supported in the following network topologies: wireless, Ethernet, Token Ring, FDDI, and WAN. The table Key appears immediately after the table. For the latest information on supported file types, please consult the Readme file.

The target analyzer codes (TA Codes) are provided for use when calling ProConvert from the command line (see "Command line operation").

For converting between WAN traces, the WAN types supported include PPP, Frame Relay, ISDN, HDLC (Cisco), and X25 over T1/E1.

Table 1.1 Supported formats, networks and target analyzer (TA) codes
Analyzer/Probe
Company
Network Type
File Suffix
TA Code
AiroPeek 1.1 or higher, AiroPeek NX
(also compressed as source only)
WildPackets
WLAN
*.apc
*.wpz
AP
Advisor
Agilent
Eth TR FDDI
WAN
*.dat
IA
DA-30 (DOS version)
Acterna/ WWG
Eth TR
*.an1
DA
DataGLANce
IBM
Eth TR
*.dgc
DG
Domino
Acterna/ WWG
Eth TR FDDI
WAN
*.cap
DM
EtherPeek, EtherPeek NX
(also compressed as source only)
WildPackets
Eth
*.pkt
*.wpz
EP
Fireberd500
Acterna/TTC
Eth TR
*.pkt
FB
Fireberd500 PC
Acterna/TTC
Eth TR FDDI
*.cap
SH
GigaPeek NX
(also compressed as source only)
WildPackets
Gigabit Eth
*.pkt
*.wpz
GP
Internet Advisor LAN
Agilent (pre-Win95)
Eth TR FDDI
*.eth
*.trn
HP
LAN900
Digitech, Inc.
Eth TR
*.dat
L9
LANalyzer
Novell
Eth TR
*.tr1
LZ
LAN Analyzer
Agilent
Eth TR FDDI
*.cap
SH
LinkViewPRO
Acterna/WWG
Eth TR
*.cap
LV
Network Analyzer
Agilent
Eth TR
WAN
*.dat
AN
NetMetrix Probe
(as source only)
Agilent
Eth
*.trc
(none)
NetScout Probe
(as source only)
NetScout
Eth
*.dat
(none)
NetXRay

Network Associates
Eth TR FDDI
*.cap
XR
Network Monitor (SMS 1.2)
Microsoft
Eth TR FDDI
*.cap
NM
Network Monitor (SMS 2.0)
Microsoft
Eth TR FDDI
*.cap
N2
Nokia Firewall
(as source only)
Nokia
Eth
*.dmp
(none)
Observer (through version 8.2
Network Instruments
Eth TR FDDI
WLAN
*.bfr
OB
Protocol Inspector
Fluke
Eth TR FDDI
*.cap
SH
Sniffer (DOS version)
Network Associates
Eth TR FDDI
WAN
*.enc *.trc *.fdc
*.syc
SN
SnifferPro
(also compressed as source only)
Network Associates
Eth TR FDDI WLAN
WAN
*.cap
*.caz
XR
Snoop
Sun Microsystems
Eth TR FDDI
*.snoop *.cap
SO
Surveyor or OEM
Finisar/Shomiti
Eth TR FDDI, Gigabit
*.cap
SH
tcpdump/libpcap
UNIX and Linux Platforms
Eth TR FDDI
WLAN
*.dmp
TD
TokenPeek
WildPackets
TR
*.tpc
TP
WANPeek NX
(also compressed as source only)
WildPackets
WAN
*.wpc
*.wpz
WP

Key to Table 1.1
Analyzer
Network analyzer or packet capture program used to create packet files of this type.
Probe
Network probe utilizing packet files of this type.
Company
Vendor, manufacturer, or equivalent for this packet capture program
Network Type
Types of network on which this program can be used. Choices are:

Eth = Ethernet

TR = Token Ring

FDDI = Fiber Distributed Data Interface

WLAN = IEEE 802.11 Wireless LAN

WAN = Wide Area Network
File Suffix
Required file extension for packet files created by this program
TA Code
Two letter Target Analyzer code, used to specify the file type of the destination file when using ProConvert from the command line.
(as source only)
The (as source only) marker denotes one-way conversion only. These file formats can be chosen for Source File only, and therefore do not have a TA code for use in command line operation. TA codes are used to define destination files only.

Note: Files saved by the remote capture utilities EtherHelp or PacketGrabber cannot be converted directly in ProConvert. Such files must first be opened with EtherPeek and saved under a new name. These files can then be handled by ProConvert as ordinary EtherPeek files.


Special conversion types

This section describes how ProConvert handles the following file types:

Converting tcpdump

Converting to ASCII text

Conversion between Ethernet and wireless

Conversion between WAN traces


Converting tcpdump

When you choose tcpdump/libpcap as the Format for the Destination file, a button labeled Settings appears beside the Format drop-down list. Click the Settings button to open the tcpdump/libpcap Output Options dialog, where you can make additional configuration choices for the Destination file.

Figure 1.5 tcpdump/libpcap Output Options dialog

The majority of Unix-based tcpdump implementations use the Standard format type. This is the default output. For example, if the file is to be read by a version of tcpdump running under Red Hat Linux 6.1, you can change the tcpdump/libpcap Type to Modified. Selecting Modified in tcpdump/libpcap Type will also set the Swap Bytes section to No. Again, this is to match RedHat Linux which runs on Intel platforms, using an opposite byte order from the RISC-based platforms typical of most Unix systems.


Converting tcpdump wireless

ProConvert supports converting to and from the "generic" wireless tcpdump data link type "105." This generic format does not include any RF (radio frequency) information such as channel, speed, and signal strength. When converting from tcpdump to a wireless analyzer that does support this information, you will see it filled in as Channel 1, 11 Mbps, and 100 percent signal strength, in order to avoid potential problems with statistics and expert systems. You will still get 802.11 frames and frame headers.

Note: If you use tcpdump in a channel scanning mode, you will not preserve any of the channel information even when natively saving a tcpdump file. ProConvert does not currently support conversion of tcpdump or libpcap files specific to a wireless NIC or chip set that has a data link type other than 105.

For more information on how ProConvert converts trace files to and from wireless formats, see "Conversion between Ethernet and wireless".


Converting to ASCII text

When you choose ASCII Text as the Format for the Destination file, a button labeled Settings appears beside the Format drop-down list. Click the Settings button to open the ASCII Text Settings dialog, where you can make additional configuration choices for the Destination file.

Check the appropriate checkboxes to place the Descriptive header on first line, and/or to Include Field Headers in the output text file. Choose a Delimiter to separate entries in the output file. You can choose Tab, Comma, or Fixed width. Choose which Fields to include in the output by checking the appropriate checkbox. You can choose any combination of: Frame Number, Timestamp (date), Timestamp (microseconds), Frame Length, Frame Data (hex), and Frame Data (ASCII). Click OK to enable your choices or click Cancel to close the dialog without making any changes.

Figure 6 ASCII Text Settings dialog


Conversion between Ethernet and wireless

The differences in physical media impose different requirements on Ethernet and 802.11 Wireless LAN packets. Their different packet structures require some substitutions and the deletion of some inapplicable parameters when converting from one to the other. The sections below describe the details of Ethernet to wireless and wireless to Ethernet conversion.


Ethernet-to-wireless conversion

When you convert WAN packet traces to the format of a wireless analyzer, ProConvert makes a number of translations and substitutions. The output of each frame consists of packet information for the 802.11b WLAN medium, the 802.11b MAC header, the 802.2 LLC header, and finally, the data. Each frame grows 10 or more bytes in size, depending on the encapsulation translation as noted below.

For your convenience, the wireless medium information is set to identical values for all frames, as follows: the data rate is set to 11.0 Mbps, the Channel to 1, and the signal strength to 100%. This satisfies the wireless packet information for the wireless analyzers and makes it easy to identify translated files.

An 802.11 MAC header is created that sets the frame type to "Data" and the DS bits to zero (indicating a station-to-station transfer). Destination and source addresses are set to the original Ethernet destination and source addresses, and the BSSID is set to the Ethernet source address. Sequence number, frag number, and all other bits of the MAC header are set to zero.

An 802.2 LLC header is created based on the original Ethernet encapsulation type.

Ethertype is converted to LLC SNAP Ethertype (18 byte increase in frame size)

Novell Raw is converted to LLC SAP E0 (13 byte increase in frame size)

LLC or SNAP need no conversion and are copied directly, byte for byte. (10 byte increase in frame size)

The data after the 802.2 LLC header (for example, IP and other higher level protocols) is copied identically, byte-for-byte.


Wireless-to-Ethernet conversion

Wireless traces containing data frames can be converted to Ethernet traces. ProConvert properly converts wireless 802.11a and 802.11b data frame headers to 802.3 headers, preserving the end-point source and destination MAC addresses, and retaining all of the protocol information from the LLC header and up. Because they have no meaning to an 802.3 analyzer, all wireless control and management frames are discarded when converting to 802.3. For this reason, an 802.11 trace will typically show fewer total frames when converted to 802.3.

802.11 WLAN traffic can have frames smaller or larger than those permitted on 802.3 networks. To avoid decode problems, ProConvert slices 802.11 WLAN frames to 1518 bytes (the Ethernet maximum) and sets the LLC length to 1500 bytes. 802.11 WLAN frames less than 64 bytes (the Ethernet minimum) are padded with 0's to 64 bytes.


Conversion between WAN traces

ProConvert supports two-way conversion of Wide Area Network traces from PPP, Frame Relay, ISDN, HDLC (Cisco), and X25 over T1/E1 to and from the following WAN analyzers:

WANPeek NX

Acterna/WWG Domino

Agilent Network Analyzer

HP/Agilent Advisor

Sniffer DOS (or any analyzer that can save to .syc)

SnifferPro

Figure 1.7 Conversion from a WANPeek NX file format


Technical notes

This section contains information on how ProConvert handles the following types of packet trace information or file conversion functions:

Frame data

Timestamps

CRC error information


Frame data

All frame data is preserved between analyzers. All data frames are converted; statistical information and proprietary frames, whether with statistics or other information, are discarded during conversion. The user may choose to slice each frame by specifying that only the first so many bytes of each frame be saved during conversion. The user can also choose to specify a range of frames to convert, such as frames 1 through 1000 or 2,000 through 15,000. As little as one frame can be converted by specifying a range like from 1 to 1 or from 1,500 to 1,500.


Timestamps

The program's internal conversion resolution is one microsecond. Data from analyzers with a higher stored resolution, such as Internet Advisor, will be rounded to the nearest microsecond. Data from analyzers with a lower stored resolution will be converted to that precision. Please consult your analyzer's documentation for information on its timestamp resolution.


CRC error information

CRC flags are carried over where applicable (that is, for Ethernet or wireless traces).

Some analyzers, most notably Sniffer and some Windows-based analyzers relying on off-the-shelf NDIS drivers (such as Network Monitor), do not capture the actual 32-bits of Cyclic Redundancy Check (CRC) data in Ethernet frames.

When converting to Sniffer or Network Monitor format, the CRC is stripped. When converting from Sniffer or Network Monitor to another format that does support CRCs, ProConvert re-computes the CRC and appends it to the end of the frame. If a frame is flagged as having a CRC error, its CRC is set to all zeros. The frame size is also adjusted accordingly. Hence, an Ethernet frame which appears as a 60-byte frame on Sniffer, will appear as a 64-byte frame on an analyzer such as EtherPeek, and vice-versa.

For token ring captures, no analyzers support storing the frame CRC. Thus, all conversion is done without the CRC for token ring formats.


Contacting WildPackets

During normal business hours, we are available by phone. You can also contact us by fax or email, and we will usually get back to you by the next business day.
Phone
(925) 937-3200
Domestic
(800) 466-2447
FAX
(925) 937-3211
Support
http://www.wildpackets.com/support/contact
Email
sales@wildpackets.com
Web
http://www.wildpackets.com

Our address:

WildPackets, Inc.
1340 Treat Blvd., Suite 500
Walnut Creek, CA 94597

Training and Certification:

WildPackets Academy
(800) 466-2447
See http://www.wildpackets.com/services for course catalog, current public course scheduling, web-delivered courses, and consulting services.

Product Support and Maintenance

Standard or Premium Maintenance can be purchased by contacting sales@wildpackets.com.

Resources

See http://wildpackets.com/resources for white papers, tutorials, technical briefs and more.