Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? The traffic captured in a file is generated by two programs on two servers, so I can't split the file using tcpdump 'host' or 'port' filters. I've also tried linux 'split' command :-) but with no luck. Wireshark wouldn't recognize the format.

share|improve this question
    
How large is huge? Is it much larger than availible RAM? –  pehrs Apr 13 '10 at 11:46
1  
A little late, but the reason Wireshark won't read files which are the output of split is because split will divide on exact byte boundaries. This is highly likely to split a packet which invalidates some of the file content. –  Burhan Ali Nov 14 '12 at 17:01

3 Answers 3

up vote 30 down vote accepted

You can use tcpdump itself with the -C, -r and -w options

tcpdump -r old_file -w new_files -C 10

The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.

share|improve this answer
    
thanks a lot. works great –  facha Apr 13 '10 at 11:24
    
Works great! Thanks! –  Jinghao Shi Apr 16 at 16:19
    
Awesome. Great help. Thanks. –  Brijesh Valera May 29 at 9:09

Use the editcap utility which is distributed with Wireshark.

share|improve this answer
    
editpcap -c 1000 input.pcap output.pcap will split input.pcap up into captures with a maximum of 1000 packets per capture. The output will be multiple capture files formatted like output_{index}_{timestamp}.pcap –  blachniet Feb 28 at 18:56

The best and fastest way to go is to use SplitCap, which can split large packet dump files based on sessions for example. This way you'd get each TCP session in a separate PCAP file. SplitCap can also separate packets into pcap files based on IP addresses.

You can read more about SplitCap on the Netresec blog: http://www.netresec.com/?page=Blog&month=2011-05&post=Split-or-filter-your-PCAP-files-with-SplitCap

Download SplitCap from here: http://www.netresec.com/?page=SplitCap

Good luck!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.