When trying to look at VoIP calls that span across files, I see the call using telephony>VoIP calls in the capture containing the start of the call, and obviously as it contains the call set up, however I can not see the continuation of that call by doing the same thing in subsequent files. I know I have to manually filter to see (and listen) to it, but can not find any information on how to do this. Related,,is there anyway to "splice" two files (i.e. ring buffered) files together to make one continuous? Thanks.... asked 28 Apr '16, 15:59  Templedogs |
One Answer:
Use Mergecap, which is distributed and installed with Wireshark. answered 28 Apr '16, 19:50  Rooster_50 showing 5 of 6 show 1 more comments |
Or drop multiple capture files onto the Wireshark window (does this even work with the Qt version?)
This doesn't quite work on the Qt version.....it does however still work on the Legacy version.
Indeed, there's still an open bug on Qt for that.
Thanks...did not even realize there was a merge under files...Lots to learn...thank you so much for your reply. Will play with it today....
The method Jaap and I are talking about, is to open the Legacy version of Wireshark, then select all the files you wish to merge, and then simply drag-and-drop them into the open Wireshark window. The files will be merged in chronological order. You can then save this as a merged file using the FILE | SAVE AS.
Please don't forget to Accept this answer if it answered your question.
File->Mergeworks even in Qt :-) But after each merge, you have to save the merged captures as a new file before merging in another file.