Have to large pcap file. How can i get just the voip thereout. I already tried with time selection (-A -B)
asked 23 Nov '11, 10:35
In general splitting up files is easily done with editcap
gives you two ways to split your too big capture file into smaller ones.
If you just want to filter voip out of the trace you could use tshark to grab frames matching a specific display filter and save those to a new trace like e.g. for cisco based voip with skinny as signalling protocol
answered 23 Nov '11, 13:19