I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using appending function so that the second file is just added to the bottom of the first file. But when this is done, I get -ve value in time column. How can I change this? What I intend to do is, replace these 15 smaller files with this one merged files.
You need to use
mergecap without the -a option. This will merge them chronologically based on packet timestamp.
mergecap -w mergedfile.pcap files*.pcap