Hi all, I split a pcap in 3 small pcap files and then I merged back altogether. I was supposing that the merged one is equal to initial file, but I found many differences. Could someone explain to me why?
asked 03 Oct ‘13, 06:17
edited 03 Oct ‘13, 06:18
editcap will not save the listed packets by default. You need to use the "-r" flag to save frames 1-300 to a new file like this:
answered 03 Oct '13, 07:22