How to shrink size of captured packets in multiple files?

Dmitriy
3 ●1

Hello colleagues. I've setup dumpcap with ring buffer options and now i have around 20 files and 2Gb in total. I know how I can merge all files into 1, but it's too heavy to work with 2Gb file using filters and so on. I know, that from many packets in those files I need only specific tcp.stream. My question is, how can i get file with one tcp.stream only?

Thank you.

add a comment

2 Answers

Sort by » oldest newest most voted

answered Oct 19 '3

Chuckc
3048 ●6 ●620 ●20

If you know the stream you want:
C:\>mergecap -w - *018152* | tshark -r - -w 231019_stream_2.pcapng tcp.stream==2

Or you could write a script to build a file per tcp.stream:

#!/bin/bash

for TCP_STREAM in `mergecap.exe -w - *018152* | tshark.exe -r - -T fields -e tcp.stream -Y tcp.stream | sort -n | uniq`
do
    TCP_STREAM=`echo $TCP_STREAM | tr -d "\r\n"`
    OUTFILE="211019_stream_${TCP_STREAM}.pcapng"

    mergecap.exe -w - *018152* | tshark.exe -r - -w ${OUTFILE} tcp.stream==${TCP_STREAM}
done

link

Comments

Thank you so much for your answer, this really help me a lot.

Dmitriy ( Oct 25 '3 )

add a comment

answered Oct 20 '3

Yardvark
1 ●1 ●3

Chris Greer did an interview/video where at the end he covered how he filters and merges a ton of data. Skip to the 1 hour mark for that section specifically.

https://youtu.be/ObUgYDn1zZ0?si=wk2BP...

link

Comments

Thank you, I spend time to watch that clip, very interesting.

Dmitriy ( Oct 25 '3 )

add a comment