Ethereal-users: Re: [Ethereal-users] Slice a big file into small chunks, at frame boundaries

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Mon, 11 Oct 2004 17:14:57 -0400


Stef wrote:


Is there an equivalent of mergecap, in the "opposite" direction" ? I
have tried something like:

$tethereal -r <big_file.cap> -a filesize:5000 -b 0 -w <small_chunks.cap>

but it does not work as if it would have, if reading out of an
interface (i.e. tethereal -i <if> -a ... bla,bla). The
<small_chunks.cap> ends up as a single file, with same size as
<big_file.cap>.
'editcap' can do this (by specifying frame numbers, possibly with the "-r" option, but that's not very nice).
There has also been some discussion on the development list for a tool called 'splitcap', e.g., here: 

http://www.ethereal.com/lists/ethereal-dev/200407/msg00574.html

AFAIK it has not been finished/checked in yet.