Wireshark · Wireshark-users: Re: [Wireshark-users] Reading multiple files in tcpdump

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 3, 2009, at 7:01 PM, Rayne wrote:

> I have multiple trace files all beginning with the prefix "trace1_"  
> and I would like to read all these files, apply a filter on them and  
> write the filtered packets into another pcap file.
>
> I've tried both reading from trace1* and listing all the filenames  
> after the -r option, but I keep getting syntax error.

That's because you can give only one argument to the "-r" flag (or any  
flag that takes an argument - and that's the case for most, if not  
all, command-line flags on UN*X).

> Can I read multiple files in tcpdump

No.  tcpdump will read only one file.

I assume your goal is to combine all the packets from all the traces,  
and write out a subset of those packets, selected by a filter, to  
another file.  If so, you could, as Stephen Fisher said, use mergecap  
to combine them into a file and then read the file with tcpdump and  
have it write the filtered packets to another file.  It might also be  
possible to pipe mergecap's output to its standard output, and pipe it  
to a tcpdump that you've told to read from its standard input, and  
avoid the intermediate file.