Subject: Re: snoop vs. tcpdump
To: Andrew Brown <>
From: Mark Allman <>
List: tech-net
Date: 10/05/1999 08:50:12
> so i was gonna write a little program to convert between the two
> formats.  it seems easy enough (i figured out the file formats
> from inspection after about 20 minutes), but i was wondering...
>  * is this something that's already been done?  if so, where is it?

Shawn Ostermann's (CCed) tcptrace program sort of does what you
want.  It can create tcpdump output files based on the given input
file (which can be in any number of different formats including
snoop).  I just played with it for a minute and the problem seems to
be that the program only dumps the TCP packets into the output
tcpdump file.  So, if you have files that contain lots of other
stuff (and it matters), you might have to hack the program a little.
But, the basics are there.  (And, there is a chance that Shawn will
tell us there is a magic option that makes this happen already.  I
couldn't find one, but my eyes sort of glaze over when looking at
the very long option list.).