I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine.
There are examples online, but the only one I can get to work is to mergecap them before processing them, which is very processor intensive.
ls class_all_1447887* | xargs -t -I file tcpdump -nnr file -w ~/test.cap "src 127.1.0.1"
...but it would recreate test.cap for each loop instead of adding as it went.
Is there a way to do this without making a 15GB file first from which to carve out sessions?