Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller.

Is this somehow possible?

share|improve this question
up vote 7 down vote accepted

Yes, it is possible. You can use the following command:

tcpdump -r your_input_file.pcap -w your_output_file.pcap "your_filter"

Tcpdump will read the input file, apply the filter, and then write the output file. You need just to come up with the right filter.

share|improve this answer
This worked great, thanks! – Zulakis Jan 10 '13 at 13:29

Try netsniff-ng, it sequentially processes the pcap unlike Wireshark, which tries to load everything into RAM.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.