wirshark抓包问题

爱卫生

回复 z36306610 的帖子

  你是要做Wireshark的包合并对吗？可以用wireshark自带的工具就可以了。
  这个工具在C:\Program Files\Wireshark目录下的mergecap.exe文件。你可以运行CLI进入Dos提示符。并将相应的pcap文件也拷贝到这个目录下，然后再执行下述操作。
   方法如下：
Merging lots of packet captures into a single PcapSometimes we may wish to merge multiple packet captures i.e. 4-5 100Mb Packet Captures into a single one for analysis and to remove errors such as “Ack received for unknown packet” etc. To do this, (For Windows) – Firstly, copy the packet capture to your “C:\Program files\Wireshark” folder. Then, we can use the “mergecap.exe” program, similar to how editcap works.
C:\Program Files\Wireshark\mergecap.exe -w master-cap.cap subcap1.capsubcap2.cap subcap3.capIn this command, we are merging subcap1 – subcap3 into a few file, called master-cap.cap.
Thats all there is to it. For references, some useful operators are:

   具体可参考wireshark官网的这个帮助链接。http://www.wireshark.org/docs/wsug_html_chunked/AppToolsmergecap.html

爱卫生

回复 z36306610 的帖子

  这个好像不行。但你可以同时开两个wireshark的窗口，抓不同的接口，然后再用上面的方法进行合并。就是稍微麻烦一点。另外，你在抓的时候可以设置好过滤。