Wireshark · Wireshark-users: Re: [Wireshark-users] Running tshark on large pcap files

[Christopher Maynard <Christopher.Maynard@xxxxxxxxx>]

Evan Huus <eapache@...> writes:

> > And it also doesn't seem like I can split up the files with editcap.
> > Whenever I tried to do that with the large pcap files, I got empty output
> > files (24 bytes) instead. I'm not sure if it was due to the large file size.
> 
> That's odd. If you can reproduce consistently (and perhaps with a
> smaller capture) please file a bug.

This might be bug 2868: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868

Did you try passing, "-F libpcap" to editcap?