5.4. Merging capture files

Sometimes you need to merge several capture files into one. For example, this can be useful if you have captured simultaneously from multiple interfaces at once (e.g. using multiple instances of Wireshark).

There are three ways to merge capture files using Wireshark:

5.4.1. The “Merge with Capture File” dialog box

This dialog box let you select a file to be merged into the currently loaded file. If your current data has not been saved you will be asked to save it first.

Most controls of this dialog will work the same way as described in the “Open Capture File” dialog box, see Section 5.2.1, “The “Open Capture File” dialog box”.

Specific controls of this merge dialog are:

Prepend packets to existing file
Prepend the packets from the selected file before the currently loaded packets.
Merge packets chronologically
Merge both the packets from the selected and currently loaded file in chronological order.
Append packets to existing file
Append the packets from the selected file after the currently loaded packets.

Figure 5.5. “Merge” on Microsoft Windows

ws merge win32

This is the common Windows file open dialog with additional Wireshark extensions.

Figure 5.6. “Merge” on Linux and UNIX

ws merge gtk24

This is the common Gimp/GNOME file open dialog with additional Wireshark extensions.