How to filter, split, and merge pcap files in Linux

How to filter, split, and merge pcap files in Linux

If you are a network administrator testing intrusion detection systems or some network access control policies, you often need to capture data packets and analyze these files offline. When we need to save captured data packets, we usually store pcap as the libpcap data packet format, which is widely used by many open-source sniffer tools and Packet Capturing programs. If the pcap file is used for intrusion testing or offline analysis, you must perform operations on the pcap file before injecting them into the network.

In this article, I will introduce some tools for operating pcap files and how to use them.

Editcap and Mergecap

Wireshark is the most popular GUI sniffing tool. It actually comes with a very useful set of command line tools. Including editcap and mergecap. Editcap is a 10 thousand-bit pcap editor that can filter and split pcap files in multiple ways. Mergecap can merge multiple pcap files into one. This article is based on these Wireshark command line tools.

If you have installed Wireshark, these tools are already in your system. If you have not installed the Wireshark command line tool, we will install the Wireshark command line tool. Note that on the Debian-based release, we can install the command line tool instead of Wireshark GUI, however, the entire Wireshark package needs to be installed in Red Hat and Its-based releases.

Debian, Ubuntu or Linux Mint

1. $ Sudo apt-get install wireshark-common

Fedora, CentOS or RHEL

1. $ Sudo yum install wireshark

After installing the tool, you can start to use editca and mergecap.

Pcap file filtering

Through editcap, We can filter the content in the pcap file with many different rules and save the filtering result to the new file.

First, filter the pcap file by "Start Time and End Time. The "-A <start-time> and"-B <end-time> options can filter data packets that arrive during this time period (for example, from ~ 2: 35 ). The format of time is YYYY-MM-DD HH: MM: SS ".

1. $ Editcap-A '2017-12-10 10:11:01 '-B' 2014-12-10 10:21:01 'input. pcap output. pcap

You can also extract the specified N packages from a file. The following command line extracts 100 packages (from 401 to 500) from the input. pcap file and saves them to output. pcap:

1. $ Editcap input. pcap output. pcap 401-500

You can use the "-D <dup-window>" (dup-window can be regarded as the Compare window size, which is only compared with the package in the range) option to extract the duplicate package. Each package is compared with its <dup-window>-1 package in sequence with its MD5 value. If there is a match, the package is discarded.

1. $ Editcap-D 10 input. pcap output. pcap

After traversing 37568 packets, only one repeated packet exists in 10 windows and is discarded.

You can also define <dup-window> As a time interval. Use the "-w <dup-time-window>" option to compare the packages arrived in the <dup-time-window> time.

1. $ Editcap-w 0.5 input. pcap output. pcap

50000 packages were retrieved, with s as the repeat window. Duplicate packets were not found.

Split a pcap File

Editcap can also be used to split a large pcap file into multiple small files.

Split a pcap file into multiple files with the same number of packets

1. $ Editcap-c <packets-per-file> <input-pcap-file> <output-prefix>

Each output file has the same number of packages, which are named in the form of <output-prefix>-NNNN.

Split pcap files at intervals

1. $ Editcap-I <seconds-per-file> <input-pcap-file> <output-prefix>

Merge pcap files

If you want to merge multiple files into one, It is very convenient to use mergecap.

When multiple files are merged, mergecap sorts internal data packets by time by default.

1. $ Mergecap-w output. pcap input. pcap input2.pcap [input3.pcap...]

If you want to ignore the timestamp and just merge the files in the order in the command line, use the-a option.

For example, the following command writes the content of the input. pcap file to output. pcap and appends the content of input2.pcap to the end.

1. $ Mergecap-a-w output. pcap input. pcap input2.pcap

Summary

In this tutorial, I demonstrated how to operate multiple pcap files using editcap and mergecap. In addition, there are other related tools, such as reordercap, text2pcap, which is used to convert pcap files into text formats, and pcap-diff, which are used to compare the similarities and differences between pcap files. When conducting network intrusion tests and solving network problems, these tools and package injection tools are very practical, so it is best to know about them.

Have you used the pcap tool? If you have used it, what have you done with it?

This article permanently updates the link address: