Use Mergecap to merge multiple capture files (Wireshark)

Mergecap syntax:
[root@localhost exception_pcap]# mergecap -h
Mergecap 1.10.14 (Git Rev Unknown from unknown)
Merge two or more capture files into one. (//Merge two or more capture files into one file)
See http ://www.wireshark.org for more information.
Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]
Output:
  -a concatenate rather than merge files. //Connect ( File) instead of merging files
                    default is to merge based on frame timestamps. //The default is to merge based on frame timestamps
  -s <snaplen> truncate packets to <snaplen> bytes of data. //Truncate the data packet to <snaplen> Bytes of data, -s must be followed by a decimal number (the default is 186 bytes)
  -w <outfile>|- set the output filename to <outfile> or'-' for stdout. //Set (specify) the output file name
  -F <capture type> set the output file type; default is pcapng. //Set Output file type; the default is pcapng
                    an empty "-F" option will list the file types. //
  -T <encap type> set the output file encapsulation type; //Set the output file encapsulation type
                    default is the same as the first input file. //The default value is the same as the first input file.
                    an empty "-T" option will list the encapsulation types. //
Miscellaneous:
  -h display this help and exit. //display this help and exit
  -v verbose output. //output parameters

My environment: Wireshark is installed in the Wireshark folder under Program Files on the C drive, and the source files are placed under the packet folder on the C drive

Instructions:

1. Open the command prompt as an administrator

2. Use the cd command to open the path where Wireshark is located

3. Use the mergecap command to merge files

Note:

①If you do not write the specific target address and write the generated file name directly, the merged file will be in the Wireshark installation directory

②The "*" symbol is a wildcard

③The command entered in the command prompt cannot contain Chinese, otherwise an error will be reported

 

The above method of use is personally tested, if you have any questions, welcome to communicate

Guess you like

Origin blog.csdn.net/Alex_1117/article/details/114248617