Re: mergecap doesn't merge

[Frank Schuster <frank.schuster01 () web de>]

Yes, the start time is different but is there an easy way to synchronize both?
I can calculate the difference but that is not really fun :)

But if it the only way it is ok....

Frank

> On 24 mrt 2010, at 14:18, Frank Schuster wrote:
>
> > I want to merge two files into one file, no append!!!
> > Both files begin at timestamp 0.0000s.
>
> I assume that the relative timestamps in each file begin at 0.00s. Mergecap does the merging based on the absolute 
> timestamp in the tracefiles, which makes more sense.
>
> What is the output of the command "capinfos -Tae firstfile.cap secondfile.cap"?
>
> > I tried this command:
> > mergecap -w outputfile.pcap firstfile.pcap secondfile.pcap
> >
> > But I get an mergefile, where the firstfile.pcap is the first one and between the files are a pause of 17 seconds.
> >
> > What I do wrong, why it didn't merge?
>
> I assume both files were made on different systems and that the clock on these systems were not synchronized. You 
> should compensate for the difference by using "editcap -t". You can find a presentation on how to do that at
___________________________________________________________
GRATIS für alle WEB.DE-Nutzer: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://movieflat.web.de
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe