Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?

Like -C but after the fact.

share|improve this question
is it because the files are too big or that you want them easier to read? – djangofan Mar 18 '10 at 15:50
djangofan: To big, When I load them into wireshark it faults because it can't allocate the memory. Only grabbing the default 96 snap, but they are for whole days. – Kyle Brandt Mar 18 '10 at 17:44
up vote 9 down vote accepted

I've used editcap in the past, with great success.

editcap -c 1000 large-in.pcap smaller-out

That command should generate one or more files named smaller-out-00000, smaller-out-00001 and so on, containing the firs, second, etc thousand packets from the input file.

share|improve this answer

TCPSplit will do this. It even makes sure that you don't lose TCP sessions in the break.

share|improve this answer
I've used tcpsplit for files up to 40GB, and it worked great. – Scott Pack Mar 18 '10 at 18:33

You can use editcap to do split based on number of packets (or time range), or if you really need to split based on size, try this script.

share|improve this answer

Have you looked at csplit?

share|improve this answer
csplit isn't very useful on binary files... – James Mar 18 '10 at 13:28

To simply split to a manageable size, you should be able to do it with tcpdump itself, using -C, -w and -r options. but I have not tried it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.