Can’t shrink the size of packets in a pcap

Question

Try to shrink a pcap by make each packet at most 500 bytes, the following command doesn't seem to work: the resulted file packets in "delme.pcap" is still bigger than 500 bytes.

tshark -r out.pcap -s 500 -w delme.pcap

Could it be because my tshark (v 1.10.6) is not too old? Pcap is here, note that it contains a malware.

Accepted Answer

the -s parameter in tshark command line will be used during a live capture, not when reading an existing pcap file.

If you want to modify an existing pcap, use editcap instead:

editcap -s 500 out.pcap delme.pcap