Time slicing captured files - editcap

Question

I'm trying to time slice of a captured file.

using editcap <file_in> <file_out> I get the whole input file.

Using editcp -r <file_in> <file_out> I get the output file with only a couple lines of data.

Using editcp -r -A -B yyyy-mm-dd hh:mm:ss yyyy-mm-dd hh:mm:ss <file_in> <file_out> I get error feedback of incorrect DTG.

Using editcp -r -A -B yyyy-mm-ddhh:mm:ss yyyy-mm-ddhh:mm:ss <file_in> <file_out> I get only one line in the file.

Answer 1

Let me give you an example on how to use editcap to create a timeslice of a tracefile. When you want to keep only packets with timestamps between 11:00 to 13:00 on April 14th 2011, you would use the command:

editcap -A "2011-04-14 11:00:00" -B "2011-04-14 13:00:00" infile.cap outfile.cap

Hope this helps :-)