Hi Garrick,
Chances are that smallfile doesn't have the entire contents of
bigfilename - it's probably the contents of bigfilename minus the first
10000 packets.
You're probably looking to do something like
editcap -r bigfilename smallfilename 1-10000
...which will create a file "smallfilename" with only the first 10,000
packets from bigfilename.
By default editcap assumes that you want to *exclude* the packet range
specified. By adding the -r you're telling it to only *include* (or
"retain") the packet range that you specify.
Ian
On Nov 3, 2004, at 1:56 PM, Garrick Ing wrote:
Hi,
I am trying to split a large trace file in a Endance Record Format
with editcap so that I could break it up and open it up with Ethereal.
I tried using
>editcap bigfilename smallfilename 1-10000
but it doesn't seem to split for the file and just produces a file
"smallfilename" with the entire entries of bigfilename, except in
libcap format. Is there another way I could split this trace file?
Thank you.
Garrick
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users