[SIPForum-discussion] Merge 2 Pcap/wireshark files

[Gast, Jim]

Hi, Amit S21-

Amit S0 is correct.  The good news is that merging is possible (File / Merge) . . . but the bad news is that the timestamps have to coincide to about 1ms accuracy.   If I recall correctly, merging 2 pcap files whose timestamps are off by even just a few milliseconds will drive you crazy.  You will often think a response is for one packet when it really was a reaction to a different packet.

I have also heard that you can use tcpsplice or mergecap, too.

Jim Gast , TDS Telecom

From: discussion-bounces at sipforum.org [mailto:discussion-bounces at sipforum.org] On Behalf Of Amit Ranjan Sahu
Sent: Tuesday, September 27, 2011 7:32 AM
To: Amit Salunkhe
Cc: discussion at sipforum.org
Subject: Re: [SIPForum-discussion] Merge 2 Pcap/wireshark files

Hi amit ,

You can use the merge option in the file tab and merge the two pcap files and save it with new name in wireshark .

Thanks
Amit
On Sat, Sep 24, 2011 at 9:27 AM, Amit Salunkhe <amitsalunkhe21 at gmail.com<mailto:amitsalunkhe21 at gmail.com>> wrote:
Dear All

Is there any way to merge 2 wireshrak/Pcap files, here i need to merge 2 pcap file whcih saved on desktop. I came across mergcap but that need to install and run on server,in my case i want to merge 2 file one belongs to SIP network side and other one for SS7 side reside in my desktop system.


Please let me knwo if any one on this forum know about to merge 2 pcap files.


Regards
Amit--


_______________________________________________
This is the SIP Forum discussion mailing list
TO UNSUBSCRIBE, or edit your delivery options, please visit http://sipforum.org/mailman/listinfo/discussion
Post to the list at discussion at sipforum.org<mailto:discussion at sipforum.org>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://sipforum.org/pipermail/discussion/attachments/20110927/49ef6e85/attachment-0002.html>