Wireshark · Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?

["Jake Peavy" <djstunks@xxxxxxxxx>]

On 5/19/08, Guy Harris <guy@xxxxxxxxxxxx> wrote:

Jake Peavy wrote:

> or split,

If you mean the UN*X "split", note that you'd need one with an option
such as "-b" that allows it to split binary files such as libpcap files,
*and* that none of the resulting files will be readable except for the
first, and that one will probably get an error when reading the last
packet as it will almost certainly have been split.  You'd have to have
whoever's reading the file glue the files back together with "cat".

Yes, of course.  I assumed all this was immediately obvious.

And I didn't say it was a great solution, only a potential solution.

-- 
-jp

When I found the skull in the woods, the first thing I did was call the police. But then I got curious about it. I picked it up, and started wondering who this person was, and why he had deer horns.

deepthoughtsbyjackhandy.com