How to concatenate two tcpdump files (pcap files)

Question

How to concatenate two tcpdump files, so that one traffic will appear after another in the file? To be concrete I want to "multiply" one tcpdump file, so that all the sessions will be repeated one after another sequentially few times.

Hew

Answer 1

mergecap can resolve your issue, but you must use it with '-a' option, otherwise it reorders packets temporally. Then: mergecap -a file_1.pcap file_1.pcap file_1.cap -w output_file.pcap

Annihilator

Note that mergecap is part of the "wireshark-common" package in debian-based distros – Lashondalashonde

Answer 2

As the other answers say, you can use File->Merge in Wireshark, tcpslice, or mergecap. You can also drag a file into Wireshark's main window. If Wireshark/tcpdump/snort/Ntop/etc supported pcap-ng, you'd be able to simply concatenate your capture files.

Susurrate

But don't they all just merge packet data, without caring about sequential numbers and shift of the packets in time, so that one concatenation segment is placed after another in time. – Hew

If you use File->Merge or mergecap you have the option of prepending, merging chronologically (interleaving according to timestamps), or appending. – Susurrate

Answer 3

Wireshark has the File -> Merge command which should do this.

I also remember mergecap being a tool to do so, but I haven't used it in a while.

Mathis

Answer 4

Use mergecap from Wireshark:

mergecap ... -w output.cap

Sinh

Answer 5

to join multiple pcap, use this batch script

all pcap files must be in the same folder that batch script located and also first pcap file must be named 01.pcap and second must be 02.pcap when you dir the directory, there is no other limitation.

@echo off
@setlocal enableextensions enabledelayedexpansion

set /a var1=1
set mergecapL="C:\Program Files\Wireshark"

dir /b *.pcap > list.txt
%mergecapL%\mergecap.exe -w %cd%\out%var1%.pcap %cd%\01.pcap %cd%\02.pcap
FOR /F "skip=2 delims=" %%A IN (list.txt) DO (
    set var2=!var1!
    set /a var1+=1
    %mergecapL%\mergecap.exe -w %cd%\out!var1!.pcap %cd%\out!var2!.pcap "%cd%\%%A"
    del out!var2!.pcap
)
del list.txt

Rubidium

Answer 6

Try pcapjoiner (commercial, with demo limited to 1000 packets).

Florri

Why use a commercial, closed-source, limited tool when you have mergecap? – Bronson