 | 1 | initial version |
This discussion has some different ways:
https://serverfault.com/questions/131872/how-to-split-a-pcap-file-into-a-set-of-smaller-ones
Everyone has their preference, but I prefer:
tcpdump -r old_file -w new_files -C 10
Where C is in MB. Another good discussion on the topic using editcap: