Thx,
Few of the files I want to merge show that they have a packet larger than byte size 65535...and mergecap fails...I tried the -s truncate option...but stillfails..
I think the capture device somehow left large packets inthere..anyway to get around that and still merge those files
-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of j.snelders@xxxxxxxxxx
Sent: Thursday, June 11, 2009 9:06 AM
To: wireshark-users@xxxxxxxxxxxxx
Subject: Re: [Wireshark-users] Wireshark-users: Merging a bunch of PCAP files
On Thu, 11 Jun 2009 07:36:19 -0700 Ujjval Karihaloo wrote:
> How can I merge a bunch of PCAP files. When I use Wireshark GUI, I can
only > do one at a time.
> Ujjval.
Hi Ujjval,
You can use mergecap:
http://www.wireshark.org/docs/man-pages/mergecap.html
Usage: mergecap [options] -w <outfile>|- <infile> ...
$ mergecap -w mergedfiles.cap test1.cap test2.cap test3.cap
Regards
Joan
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
