Search code examples
wiresharklibpcaptcpdumptshark

Merging/appending multiple pcap files to an existing one without overwriting

I am using tshark to filter some packets based on Display/Read filters from one file into another.

I want to have one final output file out.pcap after executing multiple read filters over number of files and combine all into out.pcap.

I was trying to use mergecap but it does not allow to append (combine) two file and store in one of them without overwriting.

Is there any way to do this, as I don't want to keep creating temporary files and merge all them together at the end.

Solution

  • This is not possible that I know of with existing tools, although given the way the capture file format is layed out, it should be possible to write a new tool (or extend mergecap) to do this.