Wireshark · Ethereal-users: Re: [Ethereal-users] Slow packet capture from file

[Guy Harris <guy@xxxxxxxxxx>]

> So, what you should've done is:
> 
> 	run "tcpdump -s 65535 -w /tmp/tcpdump.file" on the first machine
> 	and "snoop -o /tmp/snoop.file" on the second machine;
> 
> 	when you were done running tcpdump and snoop, copy both files
> 	onto some machine with Ethereal (including mergecap) on it, and
> 	run "mergecap -w merged.file tcpdump.file snoop.file";
> 
> 	run "ethereal -r merged.file" when "mergecap" completed.

Or, if the two machines capturing packets were doing so on the *same*
network - for example, to see which of the packets sent by one machine
were seen by the other machine - just run two separate instances of
Ethereal on the two capture files; merging two captures on the same
network would produce a bunch of duplicate packets, with no way of
telling which packets came from which capture.

If they were capturing on different networks, merging them might make
sense (although packets routed between the networks would still show up
twice).