Endace DAG 9.2X2 - Converting Captured Data; Dagconvert

EDM01-36v10 DAG_9.2X2_Card_User_Guide - Using your DAG card
©2010 - 2012 Endace Technology Ltd. Confidential - Version 10 - May 2012 43
Converting captured data
dagconvert is the software utility that converts captured data from ERF format to PCAP (and other
formats). Once in non ERF format the data can be read using third party applications (page 47
).
dagconvert can also be used to capture data directly into PCAP format.
Examples
To read from DAG card 0 and save to a file in ERF format:
dagconvert -d0 -o outfile.erf
To read from DAG card 0 and save to a file in PCAP format:
dagconvert -d0 -T dag:pcap -o outfile.pcap
To convert a file from ERF format to pcap format:
dagconvert -T erf:pcap -i infile.erf -o outfile.pcap
To convert a file from pcap format to ERF format, ensuring the ERF records are 64-bit aligned (and
therefore suitable for transmission using dagflood):
dagconvert -T pcap:erf -A 8 -i infile.pcap -o outfile64.erf
To capture from DAG card 0 using a BPF filter:
dagconvert -d0 -o outfile.erf -b "host 192.168.0.1 and tcp port 80"
To capture from DAG card 0 using ERF filtering:
dagconvert -d0 -o outfile.erf -f "rx,a"
To capture from DAG card 0 to a series of files of size 128 MB:
dagconvert -d0 -o outfile.erf -r 128m
The first file created is labeled
outfile0000.erf, once the file size reaches 128MB, a second file is
created. The second is labeled
outfile0001.erf etc.
dagconvert
dagconvert software utility converts data to various file formats.
Data can be input from a file or captured from a DAG card.
dagconvert can be used for converting data
captured from a DAG card to pcap format. This allows the trace file to be used with tools that support
the pcap file format. Also the reverse is possible, where data can be converted to ERF format for use in
other dag utilities.
dagconvert supported input and output formats
dagconvert supports the following input and output formats:
File format Description
dag
Read ERF records directly from DAG card (input only).
erf
ERF (Extensible Record Format) file (input and output).
atm
Legacy ATM files (input only).
eth
Legacy Ethernet files (input only).
pos
Legacy PoS files (input only).
null
Produces no input or output.
pcap
pcap(3) format file (input or output).
prt
ASCII text packet dump (output only).