how to split a pcap file into a set of smaller ones

Posted by facha on Server Fault See other posts from Server Fault or by facha
Published on 2010-04-13T08:19:29Z Indexed on 2010/04/13 8:23 UTC
Read the original article Hit count: 400

Filed under:

pcap

|

tcpdump

Hi, everyone

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? The traffic captured in a file is generated by two programs on two servers, so I can't split the file using tcpdump 'host' or 'port' filters. I've also tried linux 'split' command :-) but with no luck. Wireshark wouldn't recognize the format.

© Server Fault or respective owner

Related posts about pcap

Issue reading packets from a pcap file. dpkt

as seen on Stack Overflow - Search for 'Stack Overflow'
I am running the following test script to try to read packets from a sample .pcap file I have downloaded. import socket import dpkt import sys pcapReader = dpkt.pcap.Reader(file("test1.pcap", "rb")) for ts, data in pcapReader: ether = dpkt.ethernet.Ethernet(data) if ether.type != dpkt.ethernet… >>> More
pcap stream rotation and pruning

as seen on Server Fault - Search for 'Server Fault'
Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping only the N most recent Does not re-use output filenames Is self-contained (Ruling out, e.g., a rotation… >>> More
How to send pcap file packets on NIC?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have some network traffic captured pcap file and want to send its packets on NIC; is it possible? Is there any application to do this? >>> More
help using pcap library to sniff packets

as seen on Stack Overflow - Search for 'Stack Overflow'
i am using pcap sample codes to create my own sniffer. i downloaded their sample sniffer and its working on windows but not on linux. i am using gcc compiler on both machines, and i have only pcap.h included. the error is : dereferencing pointer to incomplete type. the netmask is causing the error… >>> More
question about pcap

as seen on Stack Overflow - Search for 'Stack Overflow'
hi, i have to do a sniffer as an assignment for the security course. i am using c and the pcap library. i got everything working well (since i got a code from the internet and changed it). but i have some questions about the code. u_int ip_len = (ih->ver_ihl & 0xf) * 4; ih is of type… >>> More

Related posts about tcpdump

Packet loss rate with iperf and tcpdump

as seen on Server Fault - Search for 'Server Fault'
I tested a line for its link quality with iperf. The measured speed (UDP port 9005) was 96Mbps, which is fine, because both servers are connected with 100Mbps to the internet. On the other hand the datagram loss rate was shown to be 3.3-3.7%, which I found a little too much. Using a high-speed transfer… >>> More
tcpdump filter that excludes private ip traffic

as seen on Server Fault - Search for 'Server Fault'
For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net 10.0.0.0/8 or src net 192.168.0.0/16) and (dst net 172.16.0.0/20 or dst net 10.0.0.0/8 or dst… >>> More
How to Break Up Large tcpdump Files

as seen on Server Fault - Search for 'Server Fault'
Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data? Like -C but after the fact. >>> More
tcpdump on dd-wrt router

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to capture packets from two devices on my network. I have tcpdump installed on my dd-wrt router and working correctly. However, the only packets I capture are broadcast packets when using a tcpdump statement that states only those two devices ./tcpdump -w /tmp/capture.pcap dst 192.168… >>> More
How can I log all traffic with its exact length?

as seen on Server Fault - Search for 'Server Fault'
I want to process all packets with their size going through our gateway server (running Debian 4.0). My idea is to use tcpdump, but I have two questions. The command I'm currently thinking of is tcpdump -i iface -n -t -q. Is it guaranteed that tcpdump will process all packets? What happens if… >>> More