Wireshark-users: Re: [Wireshark-users] merge pcap from two interfaces
From: luke devon <[email protected]>
Date: Sat, 12 May 2018 12:17:24 +0000 (UTC)
Hi Abhik, 


Thank you for the reply.

The reason is, the server got few more interfaces too. I want to capture specifically etho and etho1, Not other interfaces. That's why I can't use "-i any".

Regards
Luke

On Saturday, 12 May 2018, 6:38:55 PM GMT+8, Abhik Sarkar <[email protected]> wrote:


Alternately, run tcpdump with "-i any" to have the capture for all interfaces in the same file (unless you have good reason to keep them separate, of course).

Regards,
Abhik


On 12 May 2018 at 14:14, luke devon via Wireshark-users <[email protected]> wrote:
Hi 

I have a server which has multiple ethernet interfaces and carrying network traffic to the system. every 15sec, roll out to the next tcpdump. Likewise, it will generate 4 - pcap file in a minute. 

eth0 will generate 4 pcap files
eth1 will generate 4 pap files.

I wanna merge respective etho and eth1 files by matching with the time stamp.

can it be done? Please help.

Thank you
Luke 


______________________________ ______________________________ _______________
Sent via:    Wireshark-users mailing list <[email protected] >
Archives:    https://www.wireshark.org/ lists/wireshark-users
Unsubscribe: https://www.wireshark.org/ mailman/options/wireshark- users
             mailto:wireshark-users- [email protected]?subject= unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <[email protected]>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
            mailto:[email protected]?subject=unsubscribe