This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Guys,

I tried to split a 1,3GB pcapng file with following instruction:

editcap -i 60 "input.pcapng" "output.pcapng"

This seems to be working correctly. But If I try to open those splitted files, wireshark just hangs and nothing happens. Somebody any idea?

Greets Kay

asked 10 Jan '17, 08:24

rocKay's gravatar image

rocKay
6113
accept rate: 0%

edited 10 Jan '17, 08:27

can you try splitting by packet number using "-c" instead, e.g. "-c 100000" to see if that works?

(11 Jan '17, 14:31) Jasper ♦♦

i've tried that also, but with the same result.

(11 Jan '17, 23:39) rocKay

Could you post a 'capinfos' analysis of one such file? Even better, are you able to share one such split up file?

(12 Jan '17, 02:05) Jaap ♦

Splitted File

Alright, attached one of the splitted files.

(12 Jan '17, 03:14) rocKay

I got no problem opening the file with Wireshark 2.2.2 on Linux x64. On which OS are you running your test?

(12 Jan '17, 08:54) Pascal Quantin

Running on Win7 x64. I've tried again and after a very long time the record opened also for me. But that was really much longer than opening the original 1,3GB one. I get "Wireshark (no reaction)" in the program and it seems to hang.

(13 Jan '17, 01:14) rocKay

For the heck of it, you could try to write (via "-F pcap") a .pcap file instead of the default .pcapng file?

(17 Jan '17, 12:23) cmaynard ♦♦
showing 5 of 7 show 2 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×33
×2

question asked: 10 Jan '17, 08:24

question was seen: 843 times

last updated: 17 Jan '17, 12:23

p​o​w​e​r​e​d by O​S​Q​A