I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? The traffic captured in a file is generated by two programs on two servers, so I can't split the file using tcpdump 'host' or 'port' filters. I've also tried linux 'split' command :-) but with no luck. Wireshark wouldn't recognize the format.
You can use tcpdump itself with the -C, -r and -w options
The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.
The best and fastest way to go is to use SplitCap, which can split large packet dump files based on sessions for example. This way you'd get each TCP session in a separate PCAP file. SplitCap can also separate packets into pcap files based on IP addresses.
You can read more about SplitCap on the Netresec blog: http://www.netresec.com/?page=Blog&month=2011-05&post=Split-or-filter-your-PCAP-files-with-SplitCap
Download SplitCap from here: http://www.netresec.com/?page=SplitCap