This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a 200GB pcap file which I need to decode as FAST. As wireshark cannot open that huge file, I have to split the file into smaller files and decode each file and it has to be done using a script because I will end up with around 1000 files. So I need to be able to decode a file through a command line interface. As I've observed in the wireshark user guide there's a -d option which is the same as Decode as in the GUI version. however, my wireshark does not recognize -d as a valid option. I have also used tshark but it does not FAST as a valid dissector. I would appreciate if anyone could help me with this problem. Why there is no -d option in wireshark and tshark does not recognize FAST while there is FAST dissector available in wireshark GUI version. What's the best way to dissect a massive pcap file?

Thanks.

asked 20 Feb '13, 13:29

fhaghigh's gravatar image

fhaghigh
16224
accept rate: 0%

edited 21 Feb '13, 18:57

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


Are you talking about the FAST dissector plugin? If so, then it might be better to ask the authors of that plugin how and if it works with your version of Wireshark.

Their web site

http://code.google.com/p/fast-wireshark/

There is an example how to "decode as FAST" (tshark option -o).

http://code.google.com/p/fast-wireshark/source/browse/trunk/util/client/example-tshark.sh

Regarding your question how to split a large capture file. Please read the following questions/answers.

http://ask.wireshark.org/questions/18730/problem-in-opening-large-size-wireshark-file
http://ask.wireshark.org/questions/16690/split-pcap-file-into-smaller-pcap-file-according-to-tcp-flow

Maybe SplitCap and/or CapLoader are also interesting for you

http://www.netresec.com/?page=SplitCap
http://www.netresec.com/?page=CapLoader

Regards
Kurt

permanent link

answered 20 Feb '13, 14:09

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 20 Feb '13, 14:16

Thanks so much for your help.

(21 Feb '13, 06:33) fhaghigh

You're welcome.

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(21 Feb '13, 08:01) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×238
×14
×5

question asked: 20 Feb '13, 13:29

question was seen: 4,002 times

last updated: 21 Feb '13, 18:57

p​o​w​e​r​e​d by O​S​Q​A