Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?
Like -C
but after the fact.
Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?
Like -C
but after the fact.
I've used editcap
in the past, with great success.
editcap -c 1000 large-in.pcap smaller-out
That command should generate one or more files named smaller-out-00000
, smaller-out-00001
and so on, containing the firs, second, etc thousand packets from the input file.
You can use editcap
to do split based on number of packets (or time range), or if you really need to split based on size, try this script.
Have you looked at csplit
?
To simply split to a manageable size, you should be able to do it with tcpdump itself, using -C, -w and -r options. but I have not tried it.