Wireshark · Wireshark-users: Re: [Wireshark-users] merge pcap from two interfaces

[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

Hi Luke,

You could use mergecap (https://www.wireshark.org/docs/wsug_html_chunked/AppToolsmergecap.html).

Alternately, run tcpdump with "-i any" to have the capture for all interfaces in the same file (unless you have good reason to keep them separate, of course).

Regards,

Abhik

On 12 May 2018 at 14:14, luke devon via Wireshark-users <wireshark-users@xxxxxxxxxxxxx> wrote:

Hi 

I have a server which has multiple ethernet interfaces and carrying network traffic to the system. every 15sec, roll out to the next tcpdump. Likewise, it will generate 4 - pcap file in a minute. 

eth0 will generate 4 pcap files

eth1 will generate 4 pap files.

I wanna merge respective etho and eth1 files by matching with the time stamp.

can it be done? Please help.

Thank you

Luke 

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe