Friday, December 10, 2010

Splitting PCAP or CAP Files

Tool that comes with Wireshark has inbuilt split of the captures. In case if you set the file to higher size, then you can split the file as below.


C:\Program Files\Wireshark\editcap.exe  -c numberofpackets   infile outfile

In linux,

path of wireshark in most of the systems will be in the PATH

editcap -c numberofpackets infile outfile

should split the files into smaller size.

No comments: