How to Break Up Large tcpdump Files

Solution 1:

I've used editcap in the past, with great success.

editcap -c 1000 large-in.pcap smaller-out

That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.

Solution 2:

TCPSplit will do this. It even makes sure that you don't lose TCP sessions in the break.

Solution 3:

You can use editcap to do split based on number of packets (or time range), or if you really need to split based on size, try this script.

How to Break Up Large tcpdump Files

Solution 1:

Solution 2:

Solution 3:

Related

Recent Posts