Use Editcap to select a range of packets and output them to a new file.
Wes
--- On Thu, 6/11/09, Ujjval Karihaloo <ujjval@xxxxxxxxxxxxxxxx> wrote:
> From: Ujjval Karihaloo <ujjval@xxxxxxxxxxxxxxxx>
> Subject: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files
> To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
> Date: Thursday, June 11, 2009, 2:10 PM
> Thx,
>
> Few of the files I want to merge show that
> they have a packet larger than byte size 65535...and
> mergecap fails...I tried the -s truncate option...but
> stillfails..
>
> I think the capture device somehow left large packets
> inthere..anyway to get around that and still merge those
> files
>
>
>
>
> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-users-bounces@xxxxxxxxxxxxx]
> On Behalf Of j.snelders@xxxxxxxxxx
> Sent: Thursday, June 11, 2009 9:06 AM
> To: wireshark-users@xxxxxxxxxxxxx
> Subject: Re: [Wireshark-users] Wireshark-users: Merging a
> bunch of PCAP files
>
> On Thu, 11 Jun 2009 07:36:19 -0700 Ujjval Karihaloo wrote:
>
> > How can I merge a bunch of PCAP files. When I use
> Wireshark GUI, I can
> only > do one at a time.
> > Ujjval.
>
>
> Hi Ujjval,
>
> You can use mergecap:
> http://www.wireshark.org/docs/man-pages/mergecap.html
> Usage: mergecap [options] -w <outfile>|-
> <infile> ...
>
> $ mergecap -w mergedfiles.cap test1.cap test2.cap
> test3.cap
>
> Regards
> Joan
>
>
>
>
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
