Not Showing Ethernet Info When Convert into .pcap

[Faris]

Hi,
I have been using fiddler from last 4 months and whenever I convert .saz file into .pcap it hides the Ethernet II information, as the picture is attached for the reference.

Regards,
Faris Alyy

[Nick Iliev]

Hello Faris,

 

The described behavior is expected due to the differences between SAZ and PCAP formats. The official SAZ format description is as follows:

Session Archive Zip (SAZ) files are used to store HTTP(S) traffic for later examination.

So that said, the SAZ will only store information from the application OSI layer (layer 7). The PCAP format on other hand is storing information from layers 2 to 7. The information for the network format is stored in the 2nd OSI layer. So that said, it is expected that the information from the second layer won't be present in the SAZ archive.

 

Side note: I've noticed that you have posted the same question in three different threads. I guess this is by mistake so I will close the other thread as duplicates.

 

Regards,
Nick Iliev
Progress Telerik

[Faris]

Thanks Nick for your timely response, I just want know if there is any option through which I modify fiddler to capture the required Layer 2 information

[Nick Iliev]

Hey  Faris,

 

Fiddler is an HTTP proxy that provides information from the 7th OSI layer and some of the information from other OSI levels like the source and the destination IP, port, MIME type, TLS, SSL versions, etc. However, it won't provide you with information from the Data Link layer.

 

Regards,
Nick Iliev
Progress Telerik

[Faris]

Hey Nick,

Can you please tell me is there any Add-on or Third-party Extension for getting the mac/physical addresses of source and destination while using Fiddler.

[Nick Iliev]

Hey Faris,

I don't think such an extension/plugin exists - at least not one I am aware of.

 

Regards,
Nick Iliev
Progress Telerik

[Faris]

Thanks Nick, for your timely support please help out how can I import saz pcap into fiddler as I tried it shows error and I'm unable to see it for your ease i attached the error snap

[Nick Iliev]

Hey Faris,

 

I've just posted some additional thoughts on what might be happening with your PCAP import in the original thread.

 

Regards,
Nick Iliev
Progress Telerik