Wireshark-users: [Wireshark-users] Splitting up large .pcap file results in inconsistent times
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Yida Gao <yidapb@xxxxxxxxx>
Date: Wed, 28 Jul 2010 12:13:09 -0400
Hi Everyone,

So I have a large simulation that is about 600 seconds long.
I split up the large .pcap file using editcap:

editcap -i 100 Fulltest-1-0.pcap  100seconds.pcap

However, when I open each of the files produced (6 of them), they all start with time 0, and end at around time 99. Why aren't the files continuous with the time? I would assume the last .pcap file would go from 500 seconds to 600 seconds.

How can I make the files continuous??

My ultimate goal is just to graph the through put throughout the entire simulation.  Does anyone know of a good awk script to pull throughput of a certain node?

I appreciate the help.