Filter tcpdump file AFTER capturing

Question

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller.

Is this somehow possible?

score 17 · Accepted Answer · answered Jan 10 '13 at 13:23

Yes, it is possible. You can use the following command:

tcpdump -r your_input_file.pcap -w your_output_file.pcap "your_filter"

Tcpdump will read the input file, apply the filter, and then write the output file. You need just to come up with the right filter.

score 1 · Answer 2 · answered Jan 11 '13 at 08:59

1

Try netsniff-ng, it sequentially processes the pcap unlike Wireshark, which tries to load everything into RAM.

answered Jan 11 '13 at 08:59

Jens Meier

11
1

Filter tcpdump file AFTER capturing

2 Answers2