Wireshark · Wireshark-users: Re: [Wireshark-users] Is it possible to merge multiple capture files based on a filter?

[Hansang Bae <hbae@xxxxxxxxxx>]

ccie wrote:
> All:
> I have been searching around to no success....
>  
> I have wireshark capturing 'all' packets continuosly for 10000 files 
> (buffer ring file) of 16MB each.
> Now I need to find a way to extract certain packets based on a display 
> filter and output to another set of file.
>  
> is it possible to do this on the command-line (Windows DOS prompt) with 
> filename wild-card?

You can use tshark to parse out what you need.

tshark -r <infilename>  -R ip.addr==192.168.1.1  -w <outputfilename>

The -R will let you use any of the display filters.  Couple the above 
with some FOR loop and you should be fine.


--

Thanks,
Hansang