Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Mon, 19 May 2008 12:25:03 -0600
On Mon, May 19, 2008 at 09:15:08AM -0700, Tracy Dennis wrote:

> I'm new to the application, so I apologize if this is a stupid 
> question. I performed a capture that generated a 90 MB file, but I can 
> only FTP a 20 MB file maximum to Cisco.  Is there a way to cut out or 
> copy only a part of the capture to generate another PCAP file?

Check out the editcap command-line program that comes with Wiresdhark.  
It lets you split your 90MB file into multiple files with 'x' number of 
packets each.  ot the easiest solution, but if you play with it a bit 
you should be able to trim down your files.


Steve