0

I am trying to parse large pcap files with libpcap but there is a file limitation so my files are separated at 2gb. I have 10 files of 2gb and I want to parse them at one shot. Is there a possibility to feed this data on an interface sequentially (each file separately) so that libpcap can parse them on the same run?

2 Answers2

1

I am not aware of any tools that will allow you to replay more than one file at a time.

However, if you have the disk space, you can use mergecap to merge the ten files into a single file and then replay that.

Mergecap supports merging the packets according to

  1. chronological order of each packet's timestamp in each file
  2. ignoring the timestamps and performing what amounts to a packet version of 'cat'; write the contents of the first file to the output, then the next input file, then the next.

Mergecap is part of the Wireshark distribution.

Kelvin Edmison
  • 191
  • 3
1

I had multiple 2GB pcap files. Used the following one liner to go through each pcap file sequentially and with display filter. This worked without merging the pcap files (avoided using more disk space and cpu)

for i in /mnt/tmp1/tmp1-pcap-ens1f1-tcpdump* ; do tcpdump -nn -r $i host 8.8.8.8 and tcp ; done

**Explanation:** 
for loop
/mnt/tmp1/tmp1-pcap-ens1f1-tcpdump* # path to files with * for wildcard
do tcpdump -nn -r $i host 8.8.8.8 and tcp # tcpdump not resolving ip or port numbers and reading each file in sequence
done #

Note: Please remember to adjust the file path and display filter according to your needs.

user20796444
  • 11
  • 2