capuniq

capuniq.sh

#!/bin/sh

file="$1"
if [ -z "$file" ]; then
    echo "Usage: $0 file"
    exit 1
fi

trap "rm -f $file.k12 $file.k12.uniq $file.cap; exit 1" 0 1 2 3 15

set -e

editcap () {
    /usr/sbin/editcap "$@" >/dev/null
}

editcap -F k12text $file $file.k12
k12uniq.pl < $file.k12 > $file.k12.uniq
editcap -F libpcap -T ether -t $((`TZ=UTC date -d '00:00:00' +%s` - `date -d '2000-01-01' +%s`)) $file.k12.uniq $file.cap
touch -r $file $file.cap
test -s $file.cap && mv -f $file.cap $file
rm -f $file.k12 $file.k12.uniq

k12uniq.pl

#!/usr/bin/perl

use strict;
use warnings;

=for comment

+---------+---------------+----------+
01:03:48,722,903   ETHER
|0   |00|00|0c|07|ac|03|00|09|3d|11|2d|2b|08|00|45|00|00|28|b9|c0|40|00|40|06|ce|ba|0a|ec|10|56|ac|10|eb|02|71|8c|50|43|d4|ae|a7|a5|30|0d|a8|ae|50|10|02|da|e3|c5|00|00|00|00|00|00|00|00|

+---------+---------------+----------+
01:03:48,722,903   ETHER
|0   |00|00|0c|07|ac|03|00|09|3d|11|2d|2b|08|00|45|00|00|28|b9|c0|40|00|40|06|ce|ba|0a|ec|10|56|ac|10|eb|02|71|8c|50|43|d4|ae|a7|a5|30|0d|a8|ae|50|10|02|da|e3|c5|00|00|00|00|00|00|00|00|


=cut

my ($line, @lines, $current, $previous);
$current = '';
while ($line = <STDIN>) {
    if ($line =~ /^\|/) {
	$previous = $current;
	$current = $line;
    };
    push @lines, $line;
    if ($line =~ /^\r\n$/s) {
        if ($current ne $previous) {
	    print @lines;
	};
        @lines = ();
    };
};