How can I merge tcpdump capture files


#1

Is it possible to merge multiple tcpdump .pcap capture files into one big file?


#2

It is possible with mergecap utility which comes from wireshark-common package.

You need to give merged filename with -w parameter and other filenames which you want to merge:

$ mergecap -w merged.pcap file1.pcap file2.pcap file3.pcap

See also: man mergecap