in reply to Parsing ERF (pcap-like) format files

A better solution is to use editcap to convert ERF to PCAP and completely remove the ERF headers in the pcap. There is a good writeup here: http://www.netresec.com/?page=Blog&month=2012-11&post=Convert-Endace-ERF-capture-files-to-PCAP

/erik
  • Comment on Re: Parsing ERF (pcap-like) format files

In Section Seekers of Perl Wisdom