Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 19 May 2008 13:26:14 -0700
Jake Peavy wrote:

Yes, of course.  I assumed all this was immediately obvious.

I wouldn't assume that - people might not be aware that, for example, libpcap is a binary format (I've seen mail on various mailing lists from people trying to treat pcap files as text files), or that the file has a per-file header that will only be in the first of the split files (I think I've seen mail on mailing lists from people unaware of that), and if the files are being uploaded to Cisco tech support, the recipients might not be aware that the files have been split and need to be glued back together if they're not told.