I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using appending function so that the second file is just added to the bottom of the first file. But when this is done, I get -ve value in time column. How can I change this? What I intend to do is, replace these 15 smaller files with this one merged files. enter image description here

  • 5
    time offsets are relative to the time if the first frame. You'll want to merge the frames instead of concatenating the files. See the mergecap command. Mar 24, 2014 at 15:48

2 Answers 2


You need to use mergecap without the -a option. This will merge them chronologically based on packet timestamp.

mergecap -w mergedfile.pcap files*.pcap



This can be done using joincap.

go get -u github.com/assafmo/joincap

To merge 1.pcap and 2.pcap:

joincap 1.pcap 2.pcap > merged.pcap

I wrote joincap to overcome what I believe is bad error handling by mergecap and tcpslice.
For more details go to https://github.com/assafmo/joincap.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .