 | 1 | initial version |
If the original captures were pcapng files, and you merged them into a pcapng file, and the interfaces in the two captures have different names or some other property that lets you determine which capture the interface came from, you could identify the capture a packet came from from its interface.
Otherwise, no information is preserved about about the original capture from which the packet came, so you'd need to fall back on the "see which original capture contains a matching packet" strategy Jaap suggested.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
