Is it splitting by relative time or by actual time?
> be patient... perl is powerful be sure about it but it is slow, very
> slow!
>
> On 3/15/06, George P Nychis <gnychis@xxxxxxx> wrote:
>> oh awesome, thank you very much for all your help, I will look through
>> your script and use it :)
>>
>> - George
>>
>>
>>> On 3/14/06, George P Nychis <gnychis@xxxxxxx> wrote:
>>>> So can I do wildcards for the date? Because the log file spans
>>>> over several days and it would just be easier to wildcard out the
>>>> date.
>>>
>>> No it cannot.
>>>
>>> Attached you'll find a perl script I wrote a while ago that splits a
>>> capture file in 5m files (starting at X:00 X:05 X:10 X:15 ... ) you
>>> can modify it to fit you needs.
>>>
>>>
>>>>
>>>>> ---------- Forwarded message ---------- From: LEGO
>>>>> <luis.ontanon@xxxxxxxxx> Date: Mar 13, 2006 11:28 PM Subject: Re:
>>>>> [Ethereal-users] tethereal uses too much memory to filter
>>>>> packets from file To: Ethereal user support
>>>>> <ethereal-users@xxxxxxxxxxxx>
>>>>>
>>>>>
>>>>> I just added -A <start time> and -B <stop time> to editcap, this
>>>>> way you can select to have in the file just those packets that
>>>>> happen in a certain period of time.
>>>>>
>>>>> $ editcap -A '2005-10-10 20:30:15' -B '2005-10-10 20:30:19'
>>>>> in.pcap out.pcap
>>>>>
>>>>> This one can filter by date even a file N times bigger than the
>>>>> ram...
>>>>>
>>>>>
>>>>> you can get it
>>>>> http://www.ethereal.com/distribution/buildbot-builds/ it's on
>>>>> revision 17614 or higher.
>>>>>
>>>>> L
>>>>>
>>>>> On 3/14/06, George P Nychis <gnychis@xxxxxxx> wrote:
>>>>>> By the way, multiple tethereal runsare also acceptable, such as
>>>>>> running tethereal 6 times for each experiment to get the
>>>>>> output, then putting all the output together. However I can't
>>>>>> find time wildcards to even accomplish that...
>>>>>>
>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> I am not sure if calling this complex was the right term,
>>>>>>> however I can't seem to find the exact filter to do what I
>>>>>>> need.
>>>>>>>
>>>>>>> I ran two sets of experiments and did them within 5 minutes
>>>>>>> of each other so that they experienced similar network
>>>>>>> conditions.
>>>>>>>
>>>>>>> Therefore, experiment one ran on these minutes (inclusive) in
>>>>>>> an hour: 00-04,10-14,20-24,30-34,40-44,50-54
>>>>>>>
>>>>>>> Experiment two ran during these minutes (inclusive) in an
>>>>>>> hour: 05-09,15-19,25-29,35-39,45-49,55-59
>>>>>>>
>>>>>>> Therefore, I am looking for a filter for tethereal/ethereal
>>>>>>> so that i can see only packets from experiment one from a log
>>>>>>> file.
>>>>>>>
>>>>>>> I've read about "frame.time", but I can't figure out how to
>>>>>>> do wildcards with it, it always needs a specific day attached
>>>>>>> with it as far as i can tell.
>>>>>>>
>>>>>>> I'd greatly appreciate any help.
>>>>>>>
>>>>>>> Thanks! George
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> Ethereal-users mailing list Ethereal-users@xxxxxxxxxxxx
>>>>>>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>> _______________________________________________ Ethereal-users
>>>>>> mailing list Ethereal-users@xxxxxxxxxxxx
>>>>>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>>>>>
>>>>>
>>>>>
>>>>> -- This information is top security. When you have read it,
>>>>> destroy yourself. -- Marshall McLuhan
>>>>> _______________________________________________ Ethereal-users
>>>>> mailing list Ethereal-users@xxxxxxxxxxxx
>>>>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>>>>
>>>>>
>>>>
>>>>
>>>> --
>>>>
>>>> _______________________________________________ Ethereal-users
>>>> mailing list Ethereal-users@xxxxxxxxxxxx
>>>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>>>
>>>
>>>
>>> -- This information is top security. When you have read it, destroy
>>> yourself. -- Marshall McLuhan
>>> _______________________________________________ Ethereal-users
>>> mailing list Ethereal-users@xxxxxxxxxxxx
>>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>>
>>
>>
>> --
>>
>> _______________________________________________ Ethereal-users mailing
>> list Ethereal-users@xxxxxxxxxxxx
>> http://www.ethereal.com/mailman/listinfo/ethereal-users
>>
>
>
> -- This information is top security. When you have read it, destroy
> yourself. -- Marshall McLuhan
> _______________________________________________ Ethereal-users mailing
> list Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>
>
--