11

I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using appending function so that the second file is just added to the bottom of the first file. But when this is done, I get -ve value in time column. How can I change this? What I intend to do is, replace these 15 smaller files with this one merged files. enter image description here

Improve this question
1
  • 5
    time offsets are relative to the time if the first frame. You'll want to merge the frames instead of concatenating the files. See the mergecap command.
    – Stéphane Chazelas
    Commented Mar 24, 2014 at 15:48

2 Answers 2

Reset to default
10

You need to use mergecap without the -a option. This will merge them chronologically based on packet timestamp.

mergecap -w mergedfile.pcap files*.pcap

http://www.wireshark.org/docs/man-pages/mergecap.html

Improve this answer
2

This can be done using joincap.

go get -u github.com/assafmo/joincap

To merge 1.pcap and 2.pcap:

joincap 1.pcap 2.pcap > merged.pcap

I wrote joincap to overcome what I believe is bad error handling by mergecap and tcpslice.
For more details go to https://github.com/assafmo/joincap.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .