This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Working with file sets

0

I am performing some problem analysis this morning at a client site. I am troubleshooting a problem on their SAN network. There is a large volume of data where I am capturing from. It is so much that it shuts down wireshark after a minute and a half of capture ( I am using a very robust laptop with an i7 6 G RAM and Tera hdd).

I started to set up WS thereafter to capture using file sets. I set the file size to 20 mg per file. it writes one of these each 3 seconds. I have 63 files in the newly created file set.

What I want to do now is open the file set as one file. I saw this done once before in a tip or trick that Laura had published somewhere. I tried to figure out how to open the file set (all files) and so far have not been successful.

Thanks for any help provided

KMNRuser

asked 20 Oct '10, 07:16

kmnruser's gravatar image

kmnruser
26668
accept rate: 0%

Most likely I demonstrated opening a file from a file set and quickly moving between each file using File > File Sets.

(22 Oct '10, 15:42) lchappell ♦

2 Answers:

1

You can do the following:

  • Use File→Merge
  • Open the first file and drag subsequent files to Wireshark's main window
  • Use mergecap

answered 20 Oct '10, 10:42

Gerald%20Combs's gravatar image

Gerald Combs ♦♦
3.3k92258
accept rate: 24%

Thanks for the reply Gerald. It is quite the privelege getting an answer back from you!

(20 Oct '10, 11:44) kmnruser

1

AFAIK you cannot open them all at once, but you can jump from one file the another.
Open one of the files of the file set.
Go to File -> File Set -> List Files to open the "List Files" dialog box.
Just select a file to open another file of the file set; but the current file will be closed.

When you use a display filter, this display filter will also be applied to the next file you open.

See the Wireshark User's Guide for more information.

answered 20 Oct '10, 11:09

joke's gravatar image

joke
1.3k4934
accept rate: 9%

edited 20 Oct '10, 11:15