Wireshark · Wireshark-users: Re: [Wireshark-users] 2 gig limit on mergecap

[Guy Harris <guy@xxxxxxxxxxxx>]

Hans Nilsson wrote:
> How complicated is it to merge two capture files? Do you have to change
> much data in them or basically strip the headers of the second file and
> then append it to the first?

The answer to both of them is "no", because merging doesn't mean 
changing the data in the packets, but it also doesn't mean 
concatenating, it means *merging*, which is, by default, done by time 
stamp, so the packets are sorted by time stamp (under the assumption 
that the input files are sorted by time stamp).

It also can mean changing the per-packet record headers, as you might be 
merging two different types of capture files, e.g. a libpcap-format file 
and a Sniffer-format file.

Therefore, merging involves reading all the input files and writing out 
a single output file.