On Jan 24, 2013, at 2:43 AM, ri...@happyleptic.org wrote:
> I have a set of pcap files which packets are not stricly ordered according to
> packet timestamp.
> I'd like a tool to reorder such packets according to timestamp (without
> altering packet timestamp
> by by swapping packets in the file).
>
> I couldn't find such tool - should I write one or did I missed something
> obvious?
According to
http://ask.wireshark.org/questions/18190/utility-to-sort-pcap-or-pcapng-capture-file-based-on-timestamp
there's a "reordercap" utility in the current development version of Wireshark
that can do that:
Reordercap is a program that reads an input capture file and rewrites
the frames to an output capture file, but with the frames sorted by
increasing timestamp.
This functionality may be useful when capture files have been created
by combining frames from more than one well-synchronised source, but
the frames have not been combined in strict time order.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
