Endace DAG 5.2X, User Manual

Page: 40 / 66

EDM01-33v1 DAG_7.5G4_Card_User_Guide
36 ©2008 Endace Technology Ltd. Confidential - Version 1 - November 2008
Converting captured data
dagconvert
is the software utility that converts captured data from ERF format to Pcap (and
other formats). Once in non ERF format the data can be read using third party applications
38 (page ).
dagconvert
can also be used to capture data directly into pcap format.
Examples
To read from DAG card 0 and save to a file in ERF format:
dagconvert -d0 -o outfile.erf
To read from DAG card 0 and save to a file in pcap format:
dagconvert -d0 -T dag:pcap -o outfile.pcap
To convert a file from ERF format to pcap format:
dagconvert -T erf:pcap -i infile.erf -o outfile.pcap
To convert a file from pcap format to ERF format, ensuring the ERF records are 64-bit aligned
(and therefore suitable for transmission using dagflood):
dagconvert -T pcap:erf -A 8 -i infile.pcap -o outfile64.erf
To capture from DAG Card 0 using a BPF filter:
dagconvert -d0 -o outfile.erf -b "host 192.168.0.1 and tcp port 80"
To capture from DAG card 0 using ERF filtering:
dagconvert -d0 -o outfile.erf -f "rx,a"
To capture from DAG card 0 to a series of files of size 128 MB:
dagconvert -d0 -o outfile.erf -r 128m
The first file created is labeled
outfile0000.erf
, once the file size reaches 128MB, a second
file is created. The second is labeled
outfile0001.erf
etc.