Wireshark

  • Riverbed Technology
  • WinPcap
SHARKFEST '13 - Wireshark Developer and User Conference - June 16-19, 2013 - UC Berkeley
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: "Jake Peavy" <djstunks@xxxxxxxxx>
Date: Mon, 19 May 2008 13:25:06 -0600

On 5/19/08, Guy Harris <guy@xxxxxxxxxxxx> wrote:
Jake Peavy wrote:

> or split,

If you mean the UN*X "split", note that you'd need one with an option
such as "-b" that allows it to split binary files such as libpcap files,
*and* that none of the resulting files will be readable except for the
first, and that one will probably get an error when reading the last
packet as it will almost certainly have been split.  You'd have to have
whoever's reading the file glue the files back together with "cat".

Yes, of course.  I assumed all this was immediately obvious.

And I didn't say it was a great solution, only a potential solution.

--
-jp

When I found the skull in the woods, the first thing I did was call the police. But then I got curious about it. I picked it up, and started wondering who this person was, and why he had deer horns.

deepthoughtsbyjackhandy.com

  • Follow-Ups:
    • Re: [Wireshark-users] edit a pcap capture to shorten file length?
      • From: Guy Harris
  • References:
    • [Wireshark-users] edit a pcap capture to shorten file length?
      • From: Tracy Dennis
    • Re: [Wireshark-users] edit a pcap capture to shorten file length?
      • From: Stephen Fisher
    • Re: [Wireshark-users] edit a pcap capture to shorten file length?
      • From: Jake Peavy
    • Re: [Wireshark-users] edit a pcap capture to shorten file length?
      • From: Guy Harris
  • Prev by Date: [Wireshark-users] Betr: Re: edit a pcap capture to shorten file length?
  • Next by Date: [Wireshark-users] Betr: read ATM capture files with PPPoE encapsulation?
  • Previous by thread: Re: [Wireshark-users] edit a pcap capture to shorten file length?
  • Next by thread: Re: [Wireshark-users] edit a pcap capture to shorten file length?
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation