Roger Schenck wrote: >I have a 175+MB capture file that obviously is very difficult to open >and look through for the issues. Do you have any suggestions on a method >to truncate the existing file or possibly split it into a couple of >files to make it more manageable?
There is a program called editcap that is included in the Etheral distribution and can e.g be used to extract a range of frame numbers from a capture file and put it into another file. In order to split a large capture file into several files you'll have to use editcap several times (use a script). I have not used editcap on really large files, so I don't know how well it works. http://www.ethereal.com/docs/user-guide/x2744.html http://ethereal.archive.sunet.se/lists/ethereal-users/200211/msg00000.html http://ethereal.archive.sunet.se/lists/ethereal-users/200211/msg00037.html There is also a program called tcpslice that can be used to split libpcap files dependant on the timestamps. I have not used tcpslice at all (and I don't know if it's available for Windows). None of these programs seems to be ideal for the thing that you want to do. Regards, Martin
