Ethereal-users: Re: [Ethereal-users] Large files...

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Sat, 29 Mar 2003 16:40:16 +0100
Roger Schenck wrote:
>I have a 175+MB capture file that obviously is very difficult to open
>and look through for the issues. Do you have any suggestions on a method
>to truncate the existing file or possibly split it into a couple of
>files to make it more manageable?


There is a program called editcap that is included in the Etheral distribution and can e.g be used to extract
a range of frame numbers from a capture file and put it into another file.
In order to split a large capture file into several files you'll have to use editcap several times
(use a script). I have not used editcap on really large files, so I don't know how well
it works.
http://www.ethereal.com/docs/user-guide/x2744.html
http://ethereal.archive.sunet.se/lists/ethereal-users/200211/msg00000.html
http://ethereal.archive.sunet.se/lists/ethereal-users/200211/msg00037.html

There is also a  program called tcpslice that can be used to split libpcap files dependant on the timestamps.
I have not used tcpslice at all (and I don't know if it's available for Windows). 

None of these programs seems to be ideal for the thing that you want to do.

Regards,
 Martin