Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?
Like -C
but after the fact.
tcpdump
Is there something that can break up tcpdump file after the captuure and make sure the breaks are on the border of packet data?
Like -C
but after the fact.
Best Answer
I've used
editcap
in the past, with great success.That command should generate one or more files named
smaller-out-00000
,smaller-out-00001
and so on, containing the firs, second, etc thousand packets from the input file.