I want to analyze packet capture file, but it has some duplicate packets. For e.g., I am setting packet count to 10000 and seeing 11085 count in wireshark. So the goal is to remove duplicate packets which are 1085 in count. I am using latest wireshark version 1.10.2. I would like to know if there is any way (command line option) using which I can discard duplicate packets and make new pcap with all unique packets. |
You can use editcap to remove duplicate frames.
See the man page for editcap: http://www.wireshark.org/docs/man-pages/editcap.html Options: -d, -D or -w Regards Thanks Kurt!
(15 Oct '13, 07:17)
npatel
|