This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can mergecap write gzipped files directly?

0

I see in the documentation that mergecap reads and expands gzipped pcap files on the fly. However, I can't see any option for creating a gzipped file as the result of the merge, ditto for editcap. I'm using Windows 7.

Does such an option exist?

If not, are there any plans to add it?

asked 26 Apr '16, 17:41

LurkingKiwi's gravatar image

LurkingKiwi
6112
accept rate: 0%


One Answer:

0

No, there doesn't appear to be a way to convince mergecap or editcap to write gzip'd files.

It appears making 'editcap' do it would be quite easy: it just needs a command-line option and to pass a boolean (based on that option) to wtap_dump_open_ng().

mergecap doesn't currently use the wiretap routines so making it write gzip'd files would be harder.

I can't find any enhancement requests asking for such functionality. You could always open one if you could use the functionality. If you do, please be sure to:

  1. Mention this question in the bug
  2. Add a comment here with a link to the bug

answered 27 Apr '16, 06:30

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

(27 Apr '16, 16:42) LurkingKiwi