Revision history [back]

The Wireshark suite includes editcap that can be used to split a capture file into multiple parts.

There are options to split with a limit of the number of packets per file, -c or by interval (seconds per capture, -i.

There are also options to cut the length of each packet, -s, for example if you don't need traffic above the TCP layer.