Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 7 down vote favorite
3

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?

Like -C but after the fact.

share|improve this question
is it because the files are too big or that you want them easier to read? – djangofan Mar 18 '10 at 15:50
djangofan: To big, When I load them into wireshark it faults because it can't allocate the memory. Only grabbing the default 96 snap, but they are for whole days. – Kyle Brandt♦ Mar 18 '10 at 17:44

5 Answers

up vote 9 down vote accepted

I've used editcap in the past, with great success.

editcap -c 1000 large-in.pcap smaller-out

That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.

share|improve this answer
up vote 4 down vote

TCPSplit will do this. It even makes sure that you don't lose TCP sessions in the break.

share|improve this answer
I've used tcpsplit for files up to 40GB, and it worked great. – Scott Pack Mar 18 '10 at 18:33
up vote 3 down vote

You can use editcap to do split based on number of packets (or time range), or if you really need to split based on size, try this script.

share|improve this answer
up vote 1 down vote

Have you looked at csplit?

share|improve this answer
csplit isn't very useful on binary files... – James Mar 18 '10 at 13:28
up vote 1 down vote

To simply split to a manageable size, you should be able to do it with tcpdump itself, using -C, -w and -r options. but I have not tried it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.