Wireshark-users: Re: [Wireshark-users] Reading multiple files in tcpdump

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Tue, 3 Mar 2009 20:13:55 -0700

On Tue, Mar 03, 2009 at 07:01:48PM -0800, Rayne wrote:

> I have multiple trace files all beginning with the prefix "trace1_" 
> and I would like to read all these files, apply a filter on them and 
> write the filtered packets into another pcap file.
> 
> I've tried both reading from trace1* and listing all the filenames 
> after the -r option, but I keep getting syntax error.
> 
> Can I read multiple files in tcpdump and if so, how?

I don't know about tcpdump, but with Wireshark you can use the included 
CLI command mergecap to put the files together and then read it in.


Steve