handling 150mb pcaps

edit

I usually throw them all into TraceWrangler at once (as @NJL suggested already), and use the Tools/Communication Details menu option to look at the conversations I need. Double clicking a row extracts all packets of the conversation to a new PCAP and runs Wireshark to open it for investigation.

It's also possible to use extraction tasks to extract only those conversations with a Snort alert to inspect them specificially.

TraceWrangler is available here: https://www.tracewrangler.com

Hello Everyone.

I have a error about vpn site to site

Main purpose use the video conferecen

but when i start the wireshark infor TCP DUP and Retranmission.

Please help me

I used to work with massive 800MB captures... hundreds of them.

You start using tshark for management like the following:

tshark -i 1 -b filesize:800000 -w 800mb.pcapng

Then you use tshark to read hundreds of files for certain specific things like IP address, http contains, tcp contains, frame contains, etc.

I perform a MSDOS prompt dir and dump the *.pcapng files to a 800mb.txt text file. Read it into Excel using .csv format and then create your recursive search for what ever it is you want for every file in the list. I've used it on up to 233 files x 800MB each and it works.

Cheers,

I can recommend Riverbeds Packet Analyzer. It's very snappy and makes it very easy to work with multi-GB capture files. You can filter and graph almost anything and it's easy to export a selection of traffic to Wireshark for detailed packet-by-packet analysis.

If you're after following specific TCP sessions across multiple capture files I can recommend TraceWrangler. It has it's limitations, bugs etc. but when it works it's great and makes it very easy.

Do you know what you're looking for in your captures or are you looking for something that's just "odd"?

The best thing is,when you know for what you are looking for and when it has happened. Otherwise there can be a lot of approaches. But one thing that can work is the graphical analysis. ( Looking for peaks)

I usually slice the packets and try to filter oUT the broadcasts .. assuming that's not an issue.