Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller.

Is this somehow possible?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Yes, it is possible. You can use the following command:

tcpdump -r your_input_file.pcap -w your_output_file.pcap "your_filter"

Tcpdump will read the input file, apply the filter, and then write the output file. You need just to come up with the right filter.

share|improve this answer
    
This worked great, thanks! –  Zulakis Jan 10 '13 at 13:29
add comment

Try netsniff-ng, it sequentially processes the pcap unlike Wireshark, which tries to load everything into RAM.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.