I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
http://www.wireshark.org/docs/man-pages/editcap.html -wasim On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
Thanks - it's actually quite easy! editcap -r $infile $outfile $start_packet#-$last_packet# -Avi On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk> wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
And you were so proud of finding this that you put it on the wiki also? ;) -MC On Sun, Sep 11, 2011 at 9:11 AM, Avi Marcus <avi@avimarcus.net> wrote:
Thanks - it's actually quite easy!
editcap -r $infile $outfile $start_packet#-$last_packet#
-Avi
On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk> wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070| peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
+1 ! On Mon, Sep 12, 2011 at 9:46 AM, Michael Collins <msc@freeswitch.org> wrote:
And you were so proud of finding this that you put it on the wiki also? ;) -MC
On Sun, Sep 11, 2011 at 9:11 AM, Avi Marcus <avi@avimarcus.net> wrote:
Thanks - it's actually quite easy!
editcap -r $infile $outfile $start_packet#-$last_packet#
-Avi
On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk> wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070| peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
http://wiki.freeswitch.org/wiki/Packet_Capture#Edit_.2F_Cut_a_large_pcap_fil... On Mon, Sep 12, 2011 at 21:46, Michael Collins <msc@freeswitch.org> wrote:
And you were so proud of finding this that you put it on the wiki also? ;) -MC
On Sun, Sep 11, 2011 at 9:11 AM, Avi Marcus <avi@avimarcus.net> wrote:
Thanks - it's actually quite easy!
editcap -r $infile $outfile $start_packet#-$last_packet#
-Avi
On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk> wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070| peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
Heh. I already added it 7 hours before.. merging both. -Avi On Tue, Sep 13, 2011 at 7:12 AM, Wasim Baig <wasim@convergence.pk> wrote:
http://wiki.freeswitch.org/wiki/Packet_Capture#Edit_.2F_Cut_a_large_pcap_fil...
On Mon, Sep 12, 2011 at 21:46, Michael Collins <msc@freeswitch.org> wrote:
And you were so proud of finding this that you put it on the wiki also? ;) -MC
On Sun, Sep 11, 2011 at 9:11 AM, Avi Marcus <avi@avimarcus.net> wrote:
Thanks - it's actually quite easy!
editcap -r $infile $outfile $start_packet#-$last_packet#
-Avi
On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk>wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Well. Apparently it was right under my nose - clicking "save as" in the wireshark gui lets you save all packets, from frame $x to $y, the marked ones, from the first marked one to the last... -Avi On Tue, Sep 13, 2011 at 9:14 AM, Avi Marcus <avi@avimarcus.net> wrote:
Heh. I already added it 7 hours before.. merging both. -Avi
On Tue, Sep 13, 2011 at 7:12 AM, Wasim Baig <wasim@convergence.pk> wrote:
http://wiki.freeswitch.org/wiki/Packet_Capture#Edit_.2F_Cut_a_large_pcap_fil...
On Mon, Sep 12, 2011 at 21:46, Michael Collins <msc@freeswitch.org>wrote:
And you were so proud of finding this that you put it on the wiki also? ;) -MC
On Sun, Sep 11, 2011 at 9:11 AM, Avi Marcus <avi@avimarcus.net> wrote:
Thanks - it's actually quite easy!
editcap -r $infile $outfile $start_packet#-$last_packet#
-Avi
On Sun, Sep 11, 2011 at 3:52 PM, Wasim Baig <wasim@convergence.pk>wrote:
http://www.wireshark.org/docs/man-pages/editcap.html
-wasim
On Sun, Sep 11, 2011 at 17:22, Avi Marcus <avi@avimarcus.net> wrote:
I've got a pcap file in wireshark that I want to show to someone... but I only need the first 1285 frames, not all 103k. How do I cut it..? Thanks, -Avi
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070 | peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- wasim h. baig | principal consultant | convergence pk | +92 30 0850 8070| peace be upon you ...
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Avi Marcus
-
Brad Mina
-
Michael Collins
-
Wasim Baig