editcap file splitting issue when little data
I am experiencing an issue with editcap that I was hoping someone could help with. I have a very large pcap file say 20Gb that I split up into 1 sec .pcapng chunks. The data captured in the large file represents a large amount of traffic flowing through a connection. The data rate is equal to the line speed of the given connection. I have found an occasional problem that occurs (sometimes) when the traffic source stops communicating. When the traffic source is not operating I get very little data. I would have expected that if a given 1 sec chunk contained no data I would either get an empty .pcapng file for the given time period or I would get no .pcapng at all. I could live with either of these x2 scenarios. However what I actually get is something quite different. I have copied the file listing below with the file name, file size in bytes and how many bytes are shown in the given .pcapng file when opened in Wireshark. Consider the lines below where I am missing a 20230216074903.pcapng but then get x2 20230216074905 files. I should say that this occurs only when the traffic source has stopped communicating on the network ie during period with very few packets per second say 0 to 3 per second.
The editcap command used is of the following format - "editcap Largefilepath.pcapng Smallfilepath.pcapng -i 1" in the example output below.
editcap Largefilepath.pcapng Smallfilepath.pcapng -i 1 C:\testdata\small_00877_20230216074901.pcapng 2284 19 packets C:\testdata\small_00878_20230216074902.pcapng 912 6 packets C:\testdata\small_00879_20230216074904.pcapng 388 1 packet C:\testdata\small_00880_20230216074905.pcapng 296 Empty C:\testdata\small_00881_20230216074905.pcapng 744 2 packets C:\testdata\small_00882_20230216074908.pcapng 296 Empty C:\testdata\small_00883_20230216074908.pcapng 388 1 packet C:\testdata\small_00884_20230216074910.pcapng 296 Empty C:\testdata\small_00885_20230216074910.pcapng 388 1 packet C:\testdata\small_00886_20230216074910.pcapng 652 1 packet C:\testdata\small_00887_20230216074912.pcapng 388 1 packet C:\testdata\small_00888_20230216074914.pcapng 296 Empty C:\testdata\small_00889_20230216074914.pcapng 388 1 packet C:\testdata\small_00890_20230216074915.pcapng 296 Empty C:\testdata\small_00891_20230216074915.pcapng 744 1 packet C:\testdata\small_00892_20230216074918.pcapng 296 Empty C:\testdata\small_00893_20230216074918.pcapng 388 1 packet C:\testdata\small_00894_20230216074920.pcapng 296 Empty C:\testdata\small_00895_20230216074920.pcapng 388 1 packet C:\testdata\small_00896_20230216074920.pcapng 652 1 packet C:\testdata\small_00897_20230216074922.pcapng 388 1 packet C:\testdata\small_00898_20230216074924.pcapng 296 Empty C:\testdata\small_00899_20230216074924.pcapng 388 1 packet C:\testdata\small_00900_20230216074925.pcapng 296 Empty C:\testdata\small_00901_20230216074925.pcapng 744 2 packets C:\testdata\small_00902_20230216074928.pcapng 296 Empty C:\testdata\small_00903_20230216074928.pcapng 388 1 packet C:\testdata\small_00904_20230216074930.pcapng 296 Empty C:\testdata\small_00905_20230216074930.pcapng 388 1 packet C:\testdata\small_00906_20230216074930.pcapng 652 1 packet
I tried repeating the above but instead of 1 sec chunks I tried 2 sec and 5 secs. When I do this I get the same sort of issues albeit not always at the same points in time.
Has anyone got any experience of this or has an idea of what ...
It looks like you should be able to recreate the issue with a smaller test file of the first 30 packets or so?
Can you verify that it behaves the same with the smaller file and share the capture file?
Also update question with output of
wireshark -vorHelp->About Wireshark:Wireshark.Good shout with the smaller trace file. I will get that done tomorrow but I don't think I can attached it here - <60 points.
The output was as follows -
(more)I have tried to edit your "answers" back to comments, but one with all the files still exceeds the character limit for a comment.
Captures can be posted to a shared location and then a link to the capture posted back here as a comment.
Also worth trying with an up to date version of Wireshark, e.g. 4.0.4
19067: editcap issue when splitting files with periods of little activity