Re: How to read a big pcap file?

["Ambika Tripathy" <Ambika.Tripathy () nethawk exfo com>]

HI,

You can split the Big PCAP file and then read those files. If the PCAP
file size if bigger then RAM available you may face the problem.

You can use editcap utility which is distributed with Wireshark

Or 

You can use tcpdump itself with the -C, -r and -w options

Br,
Ambika Prasad

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Subhasis
Mohapatra (submohap)
Sent: Tuesday, October 19, 2010 6:22 PM
To: tcpdump-workers () lists tcpdump org
Subject: [tcpdump-workers] How to read a big pcap file?

I have one doubt.

I have designed a tool using libpcap,but its not reading big pcaps.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.