59

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? The traffic captured in a file is generated by two programs on two servers, so I can't split the file using tcpdump 'host' or 'port' filters. I've also tried linux 'split' command :-) but with no luck. Wireshark wouldn't recognize the format.

2
  • How large is huge? Is it much larger than availible RAM?
    – pehrs
    Commented Apr 13, 2010 at 11:46
  • 3
    A little late, but the reason Wireshark won't read files which are the output of split is because split will divide on exact byte boundaries. This is highly likely to split a packet which invalidates some of the file content.
    – Burhan Ali
    Commented Nov 14, 2012 at 17:01

6 Answers 6

87

You can use tcpdump itself with the -C, -r and -w options

tcpdump -r old_file -w new_files -C 10

The "-C" option specifies the size of the file to split into. Eg: In the above case new files size will be 10 million bytes each.

3
  • Is there a way to do this without breaking apart a session? (Assuming a single session is smaller than the size limit argument).
    – spanishgum
    Commented Jan 5, 2018 at 15:57
  • Quick: tcpdump -r old_file -w new_files -C 1000 splits on every 955MB of recorded traffic
    – gies0r
    Commented Jul 25, 2019 at 10:06
  • I have a pcap file of 2GB, for me it creates only one split of 200MB and then it starts throwing error. invalid packet capture length 2704320705, bigger than snaplen of 262144
    – Daemon
    Commented Jul 27, 2022 at 16:47
25

Use the editcap utility which is distributed with Wireshark.

4
  • 9
    editpcap -c 1000 input.pcap output.pcap will split input.pcap up into captures with a maximum of 1000 packets per capture. The output will be multiple capture files formatted like output_{index}_{timestamp}.pcap
    – blachniet
    Commented Feb 28, 2014 at 18:56
  • 1
    Thank you blachniet for the example! But it's just editcap, not editpcap, right?
    – lindhe
    Commented Oct 14, 2017 at 8:43
  • One more example for getting records within the specified A-B time interval: editcap -A "2021-08-07 16:00:00.901917" -B "2021-08-07 16:30:00.901917" input.pcap output.pcap Commented Aug 9, 2021 at 10:42
  • The path for the MacOS install is /Applications/Wireshark.app/Contents/MacOS/editcap Commented Nov 8, 2021 at 7:58
4

I know this answer is a little late, but it may serve other people as well. I found a great tool for splitting pcap files: PcapSplitter. It's part of the PcapPlusPlus library which means it's cross-platform (Win32, Linux and Mac OS), and it can split pcap files based on different criteria such as file size (what you seem to need) but also by connection, client/server IP, server port (similar to protocol), packet count, etc. I found it very useful. The link above is for the source code, but if you don't want/know how to compile, I created compiled binaries for several platforms I've been using this tool with. I recommend this tool very much

EDIT: apparently a new version of PcapPlusPlus was released and it contains PcapSplitter binaries for quite a lot of platforms (Windows, Ubuntu 12.04/14.04, Mac OSX Mavericks/Yosemite/El Captian). I think it's better to use these binaries than the link I previously provided. You can find it here

2

The best and fastest way to go is to use SplitCap, which can split large packet dump files based on sessions for example. This way you'd get each TCP session in a separate PCAP file. SplitCap can also separate packets into pcap files based on IP addresses.

You can read more about SplitCap on the Netresec blog: http://www.netresec.com/?page=Blog&month=2011-05&post=Split-or-filter-your-PCAP-files-with-SplitCap

Download SplitCap from here: http://www.netresec.com/?page=SplitCap

Good luck!

2
  • 1
    Are there any linux versions ?
    – ychaouche
    Commented Dec 29, 2014 at 9:13
  • This is a nice program, put it lacks the capability to work with pcapng files. Commented Sep 22, 2015 at 8:30
0
tcpdump -w trace.pcap -W 48 -G 300 -C 100 -i any port 41110
  • -G 300 it will rotate in 5 minutes
  • -W 48 count of files
  • -C 100 file size 100 MB
  • port you can specify the port based on the application
0

If you're unsure what your PCAP file is really containing, you can visualize it using Squey, isolate packets or sessions worth of interest using arbitrary complex criteria and then export it to smaller PCAP files.

See https://squey.org/domains/cybersecurity/filter_pcaps_using_complex_criteria/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .