I see in the documentation that mergecap reads and expands gzipped pcap files on the fly. However, I can't see any option for creating a gzipped file as the result of the merge, ditto for editcap. I'm using Windows 7. Does such an option exist? If not, are there any plans to add it? asked 26 Apr '16, 17:41  LurkingKiwi |
One Answer:
No, there doesn't appear to be a way to convince mergecap or editcap to write gzip'd files. It appears making 'editcap' do it would be quite easy: it just needs a command-line option and to pass a boolean (based on that option) to mergecap doesn't currently use the wiretap routines so making it write gzip'd files would be harder. I can't find any enhancement requests asking for such functionality. You could always open one if you could use the functionality. If you do, please be sure to:
answered 27 Apr '16, 06:30  JeffMorriss ♦ |
Enhancement request created: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12385