This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to use tshark to dissect multiple pcap files at one time

0

There're multiple pcap files, I want to use tshark to dissect them at one time, how to config the input parameters?

asked 13 Jan '14, 21:46

metamatrix's gravatar image

metamatrix
56●16●16●19
accept rate: 100%

2 Answers:

1

I don't see how with tshark alone this can be achieved but you could run a mergecap before and then process the resulting file.

mergecap -w merged.pcapng  trace* 
tshark -r merged.pcapng "tcp.analysis.flags"

answered 14 Jan '14, 01:00

mrEEde's gravatar image

mrEEde
3.9k●15●22●70
accept rate: 20%

Thank you, mrEEde. I think mergecap is what I need, I just want a single output file with multiple input.

(14 Jan '14, 18:34) metamatrix

0

see the answers to the following questions for a scripted solution

Linux (and other Unix like systems)

http://ask.wireshark.org/questions/28542/converting-multiple-pcap-files-to-csv

Windows

http://ask.wireshark.org/questions/12799/how-to-convert-multiple-pcap-files-to-csv

Regards
Kurt

answered 14 Jan '14, 06:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

edited 14 Jan '14, 07:07