redirect output of editcap to tcpdump -

i want filter first 100 packets inside pcap file , show result on stdout. filtering first 100 packet used below command:

editcap -r test.pcap output.pcap 1-100

for showing result , filtering packet further purpose want used tcpdump.

tcpdump -tttt tcp , host ip 192.168.1.1 -r inputfile.pcap

i want redirect output of editcap tcpdump, this:

editcap -r test.pcap - | tcpdump -tttt tcp , host ip 192.168.1.1 -r -

but in command couldnt filter first 100 packets. possible so?? if not possible rediredt output of editcap ram , tcpdump read ram ??

thanks in advanced.

p.s way, don't want use below command, because command read packet inside file. need command read packets inside pcap file , shows finished job.

tshark -r ~/test1.pcap  -r "frame.number<20 , frame.number>10"

but in command couldnt filter first 100 packets

i.e., don't see packets?

try doing

editcap -f pcap -r test.pcap - 1-100 | tcpdump -tttt tcp , host ip 192.168.1.1 -r -

as editcap might writing out pcap-ng file , there bug in versions of libpcap when reading pcap-ng files causes filtering in tcpdump not work.

Ruby Co