Lucent Technologies Ethereal - Manual (Page 184)

C.6. mergecap: Merging multiple capture files
into one
Mergecap is a program that combines multiple saved capture files into a single output file specified
by the -w argument. Mergecap knows how to read libpcap capture files, including those of tcpdump.
In addition, Mergecap can read capture files from snoop (including Shomiti) and atmsnoop, LanA-
lyzer, Sniffer (compressed or uncompressed), Microsoft Network Monitor, AIX's iptrace, NetXray,
Sniffer Pro, RADCOM's WAN/LAN analyzer, Lucent/Ascend router debug output, HP-UX's nettl,
and the dump output from Toshiba's ISDN routers. There is no need to tell Mergecap what type of
file you are reading; it will determine the file type by itself. Mergecap is also capable of reading any
of these file formats if they are compressed using gzip. Mergecap recognizes this directly from the
file; the '.gz' extension is not required for this purpose.
By default, it writes the capture file in libpcap format, and writes all of the packets in both input
capture files to the output file. The -F flag can be used to specify the format in which to write the
capture file; it can write the file in libpcap format (standard libpcap format, a modified format used
by some patched versions of libpcap, the format used by Red Hat Linux 6.1, or the format used by
SuSE Linux 6.3), snoop format, uncompressed Sniffer format, Microsoft Network Monitor 1.x
format, and the format used by Windows-based versions of the Sniffer software.
Packets from the input files are merged in chronological order based on each frame's timestamp, un-
less the -a flag is specified. Mergecap assumes that frames within a single capture file are already
stored in chronological order. When the -a flag is specified, packets are copied directly from each
input file to the output file, independent of each frame's timestamp.
If the -s flag is used to specify a snapshot length, frames in the input file with more captured data
than the specified snapshot length will have only the amount of data specified by the snapshot
length written to the output file. This may be useful if the program that is to read the output file can-
not handle packets larger than a certain size (for example, the versions of snoop in Solaris 2.5.1 and
Solaris 2.6 appear to reject Ethernet frames larger than the standard Ethernet MTU, making them in-
capable of handling gigabit Ethernet captures if jumbo frames were used).
If the -T flag is used to specify an encapsulation type, the encapsulation type of the output capture
file will be forced to the specified type, rather than being the type appropriate to the encapsulation
type of the input capture file. Note that this merely forces the encapsulation type of the output file to
be the specified type; the packet headers of the packets will not be translated from the encapsulation
type of the input capture file to the specified encapsulation type (for example, it will not translate an
Ethernet capture to an FDDI capture if an Ethernet capture is read and '-T fddi' is specified).
Example C.3. Help information available from mergecap
$ mergecap.exe -h
mergecap version 0.10.5
Usage: mergecap [-hva] [-s <snaplen>] [-T <encap type>]
[-F <capture type>] -w <outfile> <infile> [...]
where -h produces this help listing.
-v verbose operation, default is silent
-a files should be concatenated, not merged
Default merges based on frame timestamps
-s <snaplen>: truncate packets to <snaplen> bytes of data
-w <outfile>: sets output filename to <outfile>
-T <encap type> encapsulation type to use:
ether - Ethernet
tr - Token Ring
slip - SLIP
ppp - PPP
fddi - FDDI
fddi-swapped - FDDI with bit-swapped MAC addresses
Related command line tools
170