Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the capture...). Something like wireshark's 'follow TCP stream' but for the command line (I'm afraid wireshark will consume a large amount of memory when displaying a 700 MB packet capture)

I looked at tcpflow but it seems to produce files much larger than the original pcap files and they seem not to be in pcap format.

share|improve this question
    
The files that result from tcpflow are not pcaps, they are the actual tcp payloads of the tcp streams. – chris Aug 23 '14 at 5:06

You can use tcpdump to extract the portions of the pcap that you want... suppose you're looking for packets in a socket connection between TCP/55777 on one host and TCP/80 on another. Your source file is bigfile.pcap, which is a sniffer dump of many HTTP sessions to the web host in question...

tcpdump -r bigfile.pcap -w session.pcap -s0 tcp and port 55777

That will pull all the packets going to and from TCP/55777 in bigfile.pcap and copy them into session.pcap.

share|improve this answer
    
Does -s0 have any effect when used together with -r? – kasperd Jul 19 at 22:15

tcpflow is what you want - splits pcaps into one file per TCP session

http://www.circlemud.org/jelson/software/tcpflow/

share|improve this answer
1  
as mentioned in the question, I tried it and did not understand why the resulting output files were much larger than the input (pcap) files... – Andre Holzner Nov 4 '11 at 16:15

There seems to be this tool which might work (I haven't used it personally)

http://www.netresec.com/?page=SplitCap (windows based)

SplitCap is a free (as in beer) open source pcap file splitter. SplitCap splits one big pcap file into multiple files based on TCP and UDP sessions, one pcap file per session. SplitCap can also be used to split a pcap file into one pcap file per host-pair instead of session.

share|improve this answer

You can also use PcapSplitter which is part of the PcapPlusPlus package. It does exactly what you need (which is splitting pcap files by TCP or UDP connection), it's multi-platform and it doesn't have a limit on the number of connections in the original file (so you can use it to split a large pcap file containing thousands of connections or even more). The link above is for the source code, but if you want a compiled binary - here is a link for binaries I made for several platforms

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.