Wireshark-users: Re: [Wireshark-users] Is it possible to merge multiple capture files based on a filter?

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Fri, 04 Apr 2008 22:17:27 -0400

ccie wrote:

All:
I have been searching around to no success....

I have wireshark capturing 'all' packets continuosly for 10000 files (buffer ring file) of 16MB each. Now I need to find a way to extract certain packets based on a display filter and output to another set of file. is it possible to do this on the command-line (Windows DOS prompt) with filename wild-card?

You can use tshark to parse out what you need.

tshark -r <infilename>  -R ip.addr==192.168.1.1  -w <outputfilename>

The -R will let you use any of the display filters. Couple the above with some FOR loop and you should be fine.

--

Thanks,
Hansang