Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

If the original captures were pcapng files, and you merged them into a pcapng file, and the interfaces in the two captures have different names or some other property that lets you determine which capture the interface came from, you could identify the capture a packet came from from its interface.

Otherwise, no information is preserved about about the original capture from which the packet came, so you'd need to fall back on the "see which original capture contains a matching packet" strategy Jaap suggested.