This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Writing out files every 5 minutes. Trying to trace a VOIP call that was over 15 minutes in length. Only getting 1st 5 minutes. How do I find the rest of the call ??

asked 11 Aug '15, 09:15

rtorrey's gravatar image

rtorrey
6112
accept rate: 0%


If your problem is, that the call has been splitted into 3 files, then you could use the tool mergecap to merge these files into one. Mergecap is part of the wireshark package. After you have merged the tracefiles you should be able to find the rest of the call.

permanent link

answered 11 Aug '15, 09:54

Christian_R's gravatar image

Christian_R
1.8k2625
accept rate: 16%

edited 13 Aug '15, 14:42

use mergecap. It will merge separeted pcap file into one big pcap, and than open by wireshark.

SYNOPSIS mergecap [ -a ] [ -F <file format=""> ] [ -h ] [ -s <snaplen> ] [ -T <encapsulation type=""> ] [ -v ] -w <outfile>|- <infile> [<infile> ...]

mergecap -w result.pcap 1_part.pcap 2_part.pcap 3_part.pcap ...

permanent link

answered 13 Aug '15, 14:40

Sindar's gravatar image

Sindar
6113
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×41

question asked: 11 Aug '15, 09:15

question was seen: 1,366 times

last updated: 13 Aug '15, 14:42

p​o​w​e​r​e​d by O​S​Q​A