If I have a trace with say 6000000 or more streams (TCP ,UDP) , is there an easy and fast way to save out each 1000000 stream to its own separate file, whether it be using tshark, editcap, gui, etc.? Or is the only way to do this to use a display filter for each stream and save as one by one (you know that it is impossible)? Thanks a lot asked 07 Jan '15, 04:21  mosa |
One Answer:
answered 07 Jan '15, 10:09  Kurt Knochner ♦ |
thank for your attention kurt but I want have pcap file for each 1000000 stream. the output of tcpflow and tcptrace are not a pcap file