Question:
- How do I split a single Wireshark packet capture file into several smaller files.
Procedure:
Sometimes when a customer uploads a TCP capture file, the windows might have problem opening it in the Wireshark program usually due to a memory problems in the windows.
in this case you can divide a single big TCP dump file into few smaller files which will be opened easily with Wireshark.
1. locate file editcap.exe on your computer (will be located on the same directory the Wireshark is installed, usually under C:\Program Files\Wireshark):
2. open a new command line window:
start-->run -->cmd and enter
on the command window opened write the following command as described on the bellow instructions:
C:\Program Files\Wireshark\editcap.exe" -c <number of packets per file> <location and name of the single big file> <new name to the small files>
3.the split files should be located under the users folder: