 | 1 | initial version |
I needed to do this as well. The format needs to be in pcapng format first and then use the "none" interface option in mergecap and you'll get different interface numbers.
I did:
path %PATH%;%programfiles%\wireshark
editcap host.pcap host.pcapng
editcap guest.pcap guest.pcapng
mergecap -I none -w merged.pcapng host.pcapng guest.pcapng
In merged.pcapng, "host.pcapng" is identified as interface 0 and "guest.pcapng" is interface 1.
It's helpful to add a custom column "Int" with the field "frame.interface_id" to see it easily.