#19 Analyze multiple (split) pcap files

[ju2gle]

Hi, I have about 100GB of capture data (VoIP honeypot) which is split into files of 10MB each.

I want to run pcapsipdump on them. But the problem is, I cannot run it on the individual files without loosing calls, that span over multiple files as far as I understood.

Merging them is also difficult, capacity-wise.

Many thanks,
ju2gle

[Aex Aey]

Have a look at mergecap, if you haven't already:

https://www.wireshark.org/docs/man-pages/mergecap.html

mergecap can write to stdout. pcapsipdump can read from stdin. You get the idea. Maybe sort arguments first (assuming fragments are linearly named, i.e. 0001, 0002, etc...):

mergecap -w - $(ls -rt *.pcap) | pcapsipdump -fr /dev/stdin -d .