Two typical situations may have you scratch your head: either you have one huge file containing all packets at once, or you have a ton of small files that you need to look at.

I often setup my captures for file sizes of 128 or 256MBytes, because they are still okay-ish when opened in Wireshark it takes some time to load and filter them, but its not too bad.

But when I end up with files larger than that sometimes more than 10GBytes in size that wont work anymore.

Its not so much that Wireshark cant load the file because it often can, at least the recent versions.

The developers worked hard on improving this, and you can now open files that you couldnt a couple of years ago.

Each display filter you apply re-reads the whole file from disk.

Each and every time, because Wireshark doesnt keep packets in memory, except the one packet currently decoded and displayed.

So if you apply a filter in any way, Wireshark needs to read all packets again to check if they match the current filter condition.

And this means that working on large files will be slow, and as always, time is something you often do not have when youre troubleshooting or perfoming a forensic investigation where getting to results fast is critical.

This is why it is a good idea to add the Wireshark installation path to your path variable so that you can run the command line tools everywhere.

Anyway, back to editcap: I dub it the Swiss pocket knife for PCAPs, because it has a lot of options to process capture files.

I often use it to cut big files into smaller chunks like this.

Of course this depends on the packet sizes in the original file.

For example if you need PCAP formatted files, use this command (some editcap versions may require libpcap instead of pcap as format value).

Editcap can tell you all the file formats it supports if you run it with an empty -F parameter.

The main problem here is that you may end up with a file so big that most carving tools cannot process it anymore.

This often works best, e.g.

For that you should make sure your file names are listed in chronological order, otherwise youll have time jumps in the merge file.

In that case just omit the -a parameter and let mergecap sort the frames for you.

I recommend getting a newer Wireshark installation instead of doing that.

There is a range of tools for that kind of thing, and Ill cover a few of them now.

I found a lot of tools in general, but I skipped all that were either too outdated, or didnt produce packet extractions (like tcpflow, which extracts the contents on top of TCP, not the packets themselves).

Commview For Wifi Vs Wireshark Capture