Re: Merging tcpdump files

[Marco van den Bovenkamp <marco () linuxgoeroe dhs org>]

George Xilouris wrote:

> Hello all, I have to tcpdump files one for each of the two 
> interfaces I have. The first dump file is the downlink and 
> the second is the uplink ... I want to compine them in order 
> to analyse them with tcptrace. I've tried tcpslice  " 
> tcpslice -w output file1 file2 " but the output consists only 
> of the first file plus packets from the second file that have 
> timestamps out of the limits of the first file. Do you know any way to
> do this ... ?

Take a look at the 'mergecap' utility that comes with Ethereal 
(http://www.ethereal.com). That will merge two or more dumps in 
chronological order.

--

                Regards,

                        Marco.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe