Wireshark · Ethereal-users: Re: [Ethereal-users] Slice a big file into small chunks, at frame boundaries

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Stef wrote:

> Is there an equivalent of mergecap, in the "opposite" direction" ? I
> have tried something like:
>
> $tethereal -r <big_file.cap> -a filesize:5000 -b 0 -w <small_chunks.cap>
>
> but it does not work as if it would have, if reading out of an
> interface (i.e. tethereal -i <if> -a ... bla,bla). The
> <small_chunks.cap> ends up as a single file, with same size as
> <big_file.cap>.

'editcap' can do this (by specifying frame numbers, possibly with the 
"-r" option, but that's not very nice).

There has also been some discussion on the development list for a tool 
called 'splitcap', e.g., here:

http://www.ethereal.com/lists/ethereal-dev/200407/msg00574.html

AFAIK it has not been finished/checked in yet.