Wireshark-users: Re: [Wireshark-users] mergecap doesn't merge
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Frank Schuster <frank.schuster01@xxxxxx>
Date: Wed, 24 Mar 2010 15:20:13 +0100 (CET)
Yes, the start time is different but is there an easy way to synchronize both?
I can calculate the difference but that is not really fun :)

But if it the only way it is ok....

Frank

>On 24 mrt 2010, at 14:18, Frank Schuster wrote:
>
>> I want to merge two files into one file, no append!!!
>> Both files begin at timestamp 0.0000s.
>
>I assume that the relative timestamps in each file begin at 0.00s. Mergecap does the merging based on the absolute timestamp in the tracefiles, which makes more sense.
>
>What is the output of the command "capinfos -Tae firstfile.cap secondfile.cap"?
>
>> I tried this command:
>> mergecap -w outputfile.pcap firstfile.pcap secondfile.pcap
>> 
>> But I get an mergefile, where the firstfile.pcap is the first one and between the files are a pause of 17 seconds.
>> 
>> What I do wrong, why it didn't merge?
>
>I assume both files were made on different systems and that the clock on these systems were not synchronized. You should compensate for the difference by using "editcap -t". You can find a presentation on how to do that at
___________________________________________________________
GRATIS für alle WEB.DE-Nutzer: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://movieflat.web.de