HOWTO: How to split a single Wireshark packet capture file into several smaller files

Expand / Collapse
 

HOWTO: How to split a single Wireshark packet capture file into several smaller files


Question:

  • How do I split a single Wireshark packet capture file into several smaller files.

Procedure:


Sometimes when a customer uploads a TCP capture file, the windows might have problem opening it in the Wireshark program usually due to a memory problems in the windows.
in this case you can divide a single big TCP dump file into few smaller files which will be opened easily with Wireshark.

1. locate file editcap.exe on your computer (will be located on the same directory the Wireshark is installed, usually under C:\Program Files\Wireshark):



2. open a new command line window:

start-->run -->cmd and enter
on the command window opened write the following command as described on the bellow instructions:


C:\Program Files\Wireshark\editcap.exe" -c <number of packets per file> <location and name of the single big file> <new name to the small files>



3.the split files should be located under the users folder:



To contact Trustwave about this article or to request support:


Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.

Details
Article ID: 15210
Last Modified: 2/10/2013
Type: HOWTO
Rated 5 stars based on 1 vote
Article has been viewed 3,479 times.
Options