Bin Zhou wrote:
Sometime, I capture a big size of file, but I may need to do voip calls
analysis for a snapshot. For example, it is good enough for me to see
flows of last one thousand packets.
If there is a quick way to filter out last 1000 frames without going to
the frame or packet detail level, it will be very helpful.
Thanks for your help in advance.
The only thing you could try would be to use "editcap -c xxx" to specify
how many packets you want per trace file (where xxx = how many packets
you want)
Or you could try -A option to specify when you want to start seeing the
"interesting" packets.
--
Thanks,
Hansang
