how make a diff between two pcap files ?

asked 2020-01-24 14:17:49 +0000

salwa1215 gravatar image

I have two pcap files and I want to make the difference between them. And store the difference in another pcap file. I tried diff command but it's not suitable with the binary files and I used also the pcap_diff tool but the result is inconsistent I mean pcap1 size - pcap2 size # diff pcap size Any help please

edit retag flag offensive close merge delete


I'm not sure if there are any tools do do what you want, but what do you mean by the difference? Unless both captures were taken on the same capturing host at the same time, it's likely that the timestamps will be different, meaning every packet record is different.

So, you'll have to define what you mean by the difference between the files?

grahamb gravatar imagegrahamb ( 2020-01-24 14:34:10 +0000 )edit

Both files are captured in the same time but in two different machine. One machine makes port mirorring traffic and the second the machine traffic.

salwa1215 gravatar imagesalwa1215 ( 2020-01-24 14:55:52 +0000 )edit

The records will be timestamped locally, and thus the timestamps are likely to be different, making every record appear to be different.

A further complication is that an on-machine capture may not be the same as from a tap or port mirror because, at the capturing point in the network stack, checksums and fragmentation may not have been done yet as they are handled by the NIC driver\firmware\hardware.

grahamb gravatar imagegrahamb ( 2020-01-24 15:11:46 +0000 )edit

I agree with @grahamb - both pcaps will be too different to do anything like that. Most likely the local capture will have different time stamps, frame sizes, and checksums. I don't think there's any realistic way of creating a difference pcap file.

Can I ask why you are trying to do that, anyway? What is the goal or result you need?

Jasper gravatar imageJasper ( 2020-01-24 16:44:03 +0000 )edit

Are you trying to determine which packets a port mirror drops?

Chuckc gravatar imageChuckc ( 2020-01-25 16:12:27 +0000 )edit