The command below extracts 100 packets (from 401 to 500) from input.pcap and save them as output.pcap: $ editcap input.pcap output.pcap 401-500

If you want to extract specific N packets from an input pcap file, you can also do that. The time format to use is YYYY-MM-DD HH:MM:SS. A and -B options are used to capture only those packets whose arrival time falls within a specific time range (e.g., between 2:30pm and 2:35pm). Filter a Pcap FileĮditcap allows you to filter an input pcap file in various fashions, and save the result in a new pcap file.įirst of all, you can filter an input pcap file based on start time and/or end time. Once you install Wireshark CLI tools, you can start using editcap and mergecap tools. Install Wireshark Command-line Tools on Fedora, CentOS or RHEL $ sudo yum install wireshark Install Wireshark Command-line Tools on Debian, Ubunu or Linux Mint $ sudo apt-get install wireshark-common

Note that on Debian-based distributions, you can install Wireshark command-line tools without installing Wireshark GUI, while on Red Hat based distributions, you need to install the whole Wireshark package. If not, go ahead and install Wireshark command-line tools on Linux.

If you already have Wireshark installed, these tools are already available for you. This tutorial is based on these Wireshark CLI tools. The latter allows you to merge multiple pcap files into one. The former is a versatile pcap editor which can filter or split a pcap file in various fashions. Wireshark, the most popular GUI-based packet sniffer, actually comes with a suite of very useful command-line tools. In this tutorial, I am going to introduce useful pcap manipulation tools and show their use cases. If pcap files are used as part of penetration testing or any kind of offline analysis, there's often need for manipulating pcap files before injecting them into the network. When it comes to storing packet dumps, libpcap's packet dump format ( pcap format) is the most widely used by many open-source packet sniffing and capture programs. If you are a network admin who is involved in testing an intrusion detection system or network access control policy, you may often rely on offline analysis using collected packet dumps. How to filter, split or merge pcap files on Linux

Wireshark command line filter