How to shrink size of captured packets in multiple files?

asked 2023-10-19 12:48:51 +0000

Dmitriy
3 ●1

Hello colleagues. I've setup dumpcap with ring buffer options and now i have around 20 files and 2Gb in total. I know how I can merge all files into 1, but it's too heavy to work with 2Gb file using filters and so on. I know, that from many packets in those files I need only specific tcp.stream. My question is, how can i get file with one tcp.stream only?

Thank you.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2023-10-19 17:35:51 +0000

Chuckc
2888 ●6 ●574 ●20

If you know the stream you want:
C:\>mergecap -w - *018152* | tshark -r - -w 231019_stream_2.pcapng tcp.stream==2

Or you could write a script to build a file per tcp.stream:

#!/bin/bash

for TCP_STREAM in `mergecap.exe -w - *018152* | tshark.exe -r - -T fields -e tcp.stream -Y tcp.stream | sort -n | uniq`
do
    TCP_STREAM=`echo $TCP_STREAM | tr -d "\r\n"`
    OUTFILE="211019_stream_${TCP_STREAM}.pcapng"

    mergecap.exe -w - *018152* | tshark.exe -r - -w ${OUTFILE} tcp.stream==${TCP_STREAM}
done

edit flag offensive delete link

Comments

Thank you so much for your answer, this really help me a lot.

Dmitriy ( 2023-10-25 15:23:06 +0000 )edit

add a comment

answered 2023-10-20 15:41:36 +0000

Yardvark
1 ●1 ●3

Chris Greer did an interview/video where at the end he covered how he filters and merges a ton of data. Skip to the 1 hour mark for that section specifically.

https://youtu.be/ObUgYDn1zZ0?si=wk2BP...

edit flag offensive delete link

Comments

Thank you, I spend time to watch that clip, very interesting.

Dmitriy ( 2023-10-25 15:23:29 +0000 )edit

add a comment