Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Mon, 19 May 2008 12:25:03 -0600
On Mon, May 19, 2008 at 09:15:08AM -0700, Tracy Dennis wrote:

> I'm new to the application, so I apologize if this is a stupid 
> question. I performed a capture that generated a 90 MB file, but I can 
> only FTP a 20 MB file maximum to Cisco.  Is there a way to cut out or 
> copy only a part of the capture to generate another PCAP file?

Check out the editcap command-line program that comes with Wiresdhark.  
It lets you split your 90MB file into multiple files with 'x' number of 
packets each.  ot the easiest solution, but if you play with it a bit 
you should be able to trim down your files.


Steve