Wireshark-users: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files

From: Wes <wes_r@xxxxxxxxx>
Date: Thu, 11 Jun 2009 18:07:48 -0700 (PDT)

Use Editcap to select a range of packets and output them to a new file.

Wes

--- On Thu, 6/11/09, Ujjval Karihaloo <ujjval@xxxxxxxxxxxxxxxx> wrote:

> From: Ujjval Karihaloo <ujjval@xxxxxxxxxxxxxxxx>
> Subject: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Date: Thursday, June 11, 2009, 2:10 PM
> Thx,
> 
>     Few of the files I want to merge show that
> they have a packet larger than byte size 65535...and
> mergecap fails...I tried the -s truncate option...but
> stillfails..
> 
> I think the capture device somehow left large packets
> inthere..anyway to get around that and still merge those
> files
> 
> 
> 
> 
> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx]
> On Behalf Of j.snelders@xxxxxxxxxx
> Sent: Thursday, June 11, 2009 9:06 AM
> To: wireshark-users@xxxxxxxxxxxxx
> Subject: Re: [Wireshark-users] Wireshark-users: Merging a
> bunch of PCAP files
> 
> On Thu, 11 Jun 2009 07:36:19 -0700 Ujjval Karihaloo wrote:
> 
> > How can I merge a bunch of PCAP files. When I use
> Wireshark GUI, I can
> only > do one at a time. 
> > Ujjval.
>  
> 
> Hi Ujjval,
> 
> You can use mergecap:
> http://www.wireshark.org/docs/man-pages/mergecap.html
> Usage: mergecap [options] -w <outfile>|-
> <infile> ...
> 
> $ mergecap -w mergedfiles.cap test1.cap test2.cap
> test3.cap
> 
> Regards
> Joan
> 
>        
> 
> 
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>          
>    mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>