Ethereal-users: RE: [Ethereal-users] Three big problems

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date: Mon, 4 Nov 2002 23:28:50 -0000
Justin,

> > > 1)  I have a 2GB capture file that I need to split.  I don't 
[...]
> Again, editcap only gives a single segment.  It does not 
> break up the file into many arbitrary-sized or -length 
> chunks.  See 'man split' for a text version of what I'm talking about.

I understand your requirement and it sounds like a great utility. Many a
time I've been stuck in a testbed with a large trace file and a stack of
floppies, and I spend far too much time fluffing about with WinZip.  Short
of adding new features to editcap.c (which isn't too insurmountable a task
if you know c), I can suggest that you make better use of editcap. 

This version of the split utility will mean that your big trace file will
only need to be read log2(n) times rather than log2(n) times. You'll need to
tweak the "copy" to "cp" if your lucky enough to use a real operating
system. :-)

use strict;
my $orig_file =               $ARGV[0] || "bigfile.dmp";
my $required_frames_per_file= $ARGV[1] || 2**16; 
# At (say) 100 bytes per frame a 2GB file will have 20e6 frames < 2**25 
my $max_frame=                 $ARGV[2] || 2**25;

sub split_efficient {
	my ($file_name, $frame_count,$delete_orig)=@_;
	return if $required_frames_per_file > $frame_count;

	# (ActivePerl has a bug with files > 2**31 so I need to check a
lower limit too)
	return if (-s $file_name < 50 and -s $file_name >= 0);

	my $cmd;
	my $mid_frame= int($frame_count/2);
	$cmd="editcap -r $file_name $file_name.1
".($mid_frame+1)."-$frame_count";
	`$cmd`;
	
	if ((-s "$file_name.1" < 50) and (-s "$file_name.1">0)) {
		# There's no data in this second file
		unlink "$file_name.1";
		if ($delete_orig) {
			rename 	$file_name, "$file_name.0"
		} else {
			`copy $file_name $file_name.0`;
		}
	} else {
		$cmd="editcap -r $file_name $file_name.0 1-$mid_frame";
		`$cmd`;
		unlink $file_name;
	}	
	split_efficient("$file_name.0",$mid_frame,1) ;
	split_efficient("$file_name.1",$mid_frame,1) ;
}

split_efficient($orig_file,$max_frame,0);

# Rename all those binary suffixes back into decimal.
my ($orig_prefix,$orig_suffix) = ($orig_file =~/^(.*)\.([^\.]*)$/);
for (<*.*>) {
	next unless /$orig_file((?:\.[01])+)+$/;
	my $old=$_;
	(my $suffix=$1)=~ s#\.##g;
	my $new_file="$orig_prefix.".eval("0b$suffix").".$orig_suffix";
	rename $old, $new_file;
}


-----------------------------------------------------------------------


Registered Office:
Marks & Spencer p.l.c
Michael House, Baker Street,
London, W1U 8EP
Registered No. 214436 in England and Wales.

Telephone (020) 7935 4422 
Facsimile (020) 7487 2670

www.marksandspencer.com

Please note that electronic mail may be monitored.

This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.

The registered office of Marks and Spencer Financial Services PLC, Marks and Spencer Unit Trust Management Limited, Marks and Spencer Life Assurance Limited and Marks and Spencer Savings and Investments Limited is Kings Meadow, Chester, CH99 9FB.