1

Is it possible to split PCAPS into multiple files bases on simple criteria

Origional.pcap {split on port 80} which generates the 2 following files

  • all_port_80.pcap
  • everything_else.pcap

Or would it be easier to create multiple different tcpdumps that match my criteria

Thanks

2 Answers 2

5

Just use tcpdump to read from your capture file and write out a new file:

tcpdump -r all.pcap -w port80.pcap port 80 
tcpdump -r all.pcap -w other.pcap ! port 80
1
  • Evan that is exactly what I was looking for that is awesome.
    – tkrabec
    Jan 29, 2014 at 13:40
1

Another option is to use PcapSplitter which is part of the PcapPlusPlus suite. You didn't specify the OS you're interested in but PcapSplitter works in both Windows, Linux and Mac OS X. You can use it as follows:

PcapSplitter -f all.pcap -o D:\Output -m bpf-filter -p "port 80"

It'll output two files: all-0000.pcap will contain port 80 packets and all-0001.pcap will contain the rest of the packets

Apparently the latest release of PcapPlusPlus doesn't contain this feature so you'll have to compile it yourself from source

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .