I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file. These are 1GB PCAP files from Bro's Timemachine.

There are examples online, but the only one I can get to work is to mergecap them before processing them, which is very processor intensive.

I tried...

ls class_all_1447887* | xargs -t -I file tcpdump -nnr file -w ~/test.cap "src"

...but it would recreate test.cap for each loop instead of adding as it went.

Is there a way to do this without making a 15GB file first from which to carve out sessions?

2 Answers 2


Instead of having tcpdump create a new file each time, let tcpdump write to standard output and redirect the output of the entire command to ~/test.cap.

Like this:

ls class_all_1447887* |
xargs -t -I file tcpdump -nnr file "src" > ~/test.cap

Or you can write a different file for each input file:

mkdir ~/test.cap.d
ls class_all_1447887* |
xargs -t -I file tcpdump -nnr file -w ~/test.cap.d/file.tcpd "src"

I am not familiar with NetMiner's and Wireshark's input requirements, nor about the output of tcpdump.

  • Netminer and Wireshark both claim the resulting file "appears to be damaged or corrupt". Any ideas?
    – user112802
    Nov 24, 2015 at 6:36
  • Do you know if it's possible to store multiples in one file? Where would the format be defined?
    – RobertL
    Nov 24, 2015 at 6:59
  • I found this (draconyx.net/articles/…) which talks about keeping the header intact, but I'm having trouble translating the directions to this task.
    – user112802
    Nov 24, 2015 at 7:07
  • Ok. I think I get it but I have to sleep. I will check back in 8 to 12 hours.
    – RobertL
    Nov 24, 2015 at 7:36

I am attempting to send multiple pcaps into an xargs loop in order to tcpdump them into a single file.

Tcpdump doesn't support merging pcap files.

mergecap does, but if you don't want to use it because it takes too much CPU, and if

  1. the files all have the same link-layer header type (e.g., Ethernet) and the same snapshot length;
  2. you just want to concatenate the files, because the N+1'st file has packets all of which come after the packets in the Nth file, for all values of N;

you'll need to try something similar to the solution in the "Header Manipulation Examples" section of the article you found. That example means you must treat the first file being concatenated differently from all the other files, as you'll be stripping the file header off of all the other files but not the first file.

Here's a script that should do that:

#! /bin/sh
for i in class_all_1447887*
    if [ "$first_file" = "no" ]
        # Strip off file header from tcpdump's output.
        tcpdump -r "$i" -w - "src" | \
            (dd of=/dev/null bs=24 count=1; cat)
        tcpdump -r "$i" -w - "src"
done > test.cap
  • I understand what you've written well enough to believe it would work, but thus far all of my work with regex/bash has been one-line commands. I am unclear how to take what you've written and incorporate it into an efficient method of carving pcap. This is something I need to do many times a day. After @RobertL's help last night, I have been using: ls class_all_14484[0-1]* | xargs -t -I file tcpdump -nnr file -w ~/pcaps/file.pcap "host" followed by mergecap *.pcap -w ~/results.cap How could I use your program to make this process more efficient?
    – user112802
    Nov 25, 2015 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .