Wireshark-users: Re: [Wireshark-users] mix pcap files

From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 26 Feb 2008 15:03:02 +0100
On Tue, Feb 26, 2008 at 02:02:27PM +0100, Cristina Mart?nez Jimenez wrote:
> 
> I want to analyse VoIP calls calling between mobile phones. I have an application in the mobile phone which captures the packets received in the call (pcap file). The problem is that for analizing the call I need only 1 pcap file with all the packets in the call, but what I have is 2 differents pcap files (one from each mobile phone). My question is if it is possible to mix the 2 captures in only one file. Then I would have all the traffic within the call in the same capture and I will be able to analyse it as a complete VoIP call.
> 
> Please, help me!!!

That's exacly what the tool "mergecap" can do for you. Mergecap is 
distributed with Wireshark. You can also load one tracefile in Wireshark
and select File -> Merge from the menu to merge it with the second file.

Hope this helps,
Cheers,
    Sake