snar / je2e Goto Github PK

je2e - Juniper .pcap file convertor.

    je2e [-f] [-v] infile.pcap outfile.pcap

.pcap files collected on Juniper routers written in a bit special format, (datalink type: Juniper Ethernet, not standard Ethernet) with packets entering RE missing layer2 headers and thus these packets can be read by tcpdump but will not be fully decoded by wireshark.

This utility was written to overcome wireshark limitation and what it does is just:

• opens infile and checks that is was collected on Juniper (has datalink type of Juniper Ethernet)
• reads infile packet by packet
• check if input packet has layer2 header.
• if it does - just writes packet with existing header.
• if it does not - je2e writes packet with prepended simulated ethernet header

Simulated header is constructed as follows:

• all-zero addresses are used for both source and destination mac-address
• ethertype is guessed from the first nibble of data: 4 means IPv4 and 6 IPv6.

The options are as follows:

Allow outfile overwriting. Without this option je2e will refuse to overwrite existing output file.

Be a bit more verbose about processing.

When everything is ok, je2e returns with exit code of 0 and without any output.

When error happens it will be written to stdout and exit-code will be non-zero.

Edge cases: too short packets, or packets without both l2 headers correct first nibble: in this case warning message written on stderr, however, processing continues.

Alexandre Snarskii [email protected]