Wireshark-users: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files

From: Ujjval Karihaloo <ujjval@xxxxxxxxxxxxxxxx>
Date: Thu, 11 Jun 2009 11:10:30 -0700

Thx,

    Few of the files I want to merge show that they have a packet larger than byte size 65535...and mergecap fails...I tried the -s truncate option...but stillfails..

I think the capture device somehow left large packets inthere..anyway to get around that and still merge those files




-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of j.snelders@xxxxxxxxxx
Sent: Thursday, June 11, 2009 9:06 AM
To: wireshark-users@xxxxxxxxxxxxx
Subject: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files

On Thu, 11 Jun 2009 07:36:19 -0700 Ujjval Karihaloo wrote:

> How can I merge a bunch of PCAP files. When I use Wireshark GUI, I can
only > do one at a time. 
> Ujjval.
 

Hi Ujjval,

You can use mergecap:
http://www.wireshark.org/docs/man-pages/mergecap.html
Usage: mergecap [options] -w <outfile>|- <infile> ...

$ mergecap -w mergedfiles.cap test1.cap test2.cap test3.cap

Regards
Joan

       


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe