Wireshark · Wireshark-dev: Re: [Wireshark-dev] Query on loading packets using command line options

[Alex Lindberg <alindber@xxxxxxxxx>]

I created a simple script for merging many files with the option of filtering using display filters.  Note the following script was intended for use on *inux systems.  Your mileage may very.

----------------- MergePackets.sh ----------------
#!/bin/sh

if [ "$2x" = "x" ];
	then
	echo "$0 <Path> <DisplayFilter> [<OutputFile>]"
	echo " "
	echo "The purpose of this script is to take all capture files in a directory"
	echo "and create a  single file that is filtered based on the input string."
	echo " "
	echo "This string could be an IP address, \"ip.addr == 1.1.1.1\""
	echo "or a port nunmber \"tcp.port == 1720\", etc."
	echo " "
	echo "The input must be in a display filter format."
	echo " "
	echo "If you are using a wildcard in the <Path>, please inclose with \" \" marks"
	echo " "
	echo "If OutputFile is not specified, the output will be to stdout"
	echo " "
	exit 1
fi

# Change below if Wireshark is not installed and you are using Ethereal
SHARK=tshark
#SHARK=tethereal

# Create file list
FILELIST=`ls $1`
TEMPDIR=/tmp/foobar
mkdir $TEMPDIR
i=1
for I in $FILELIST;
	do
	echo "$i $I $2"
	$SHARK -r $I -w $TEMPDIR/~$I-$i -R "$2" &>/dev/null
	i=`echo $i+1|bc`
	done

if [ "$3x" = "x" ];
	then
	# if here use stdout
	OUTFILE="-"
	else
	OUTFILE=$3
	fi

mergecap -w $OUTFILE $TEMPDIR/~*
rm -r $TEMPDIR

----------------------- End MergePackets.sh ---------------

Good Luck
Alex Lindberg