A tool for viewing timestamp, layer2 and layer3 addresses from a PCAP file. You can specify a head count (number of packets from the start of the file) and you can also specify a MAC address to search for. PCAP-ng files are not currently supported. This tool will accommodate 802.1Q tagged frames and Q-in-Q double tagged frames.

I wrote this using Go (golang) v1.5

For command line flags run, ./viewcap --help

I have produced binaries for Mac OSX 10.10.5 and Ubuntu Linux 14.04 64bit (but should work on any 64bit Linux), please look in the releases section for the zip files

go/src/> go get github.com/jordan2175/viewcap
go/src/> go install github.com/jordan2175/viewcap/
go/src/> cd github.com/jordan2175/viewcap
go/src/github.com/jordan2175/viewcap/> go build -o viewcap *.go

See GoDoc for documentation and examples.

./rewritecap --help
./viewcap -f test.pcap
./viewcap -f test.pcap --mac 68:A8:6D:18:36:92
./viewcap -f test.pcap --head=10

Contributions welcome! Please fork the repository and open a pull request with your changes or send me a diff patch file.

This is free software, licensed under the Apache License, Version 2.0.