Wireshark-users: Re: [Wireshark-users] edit a pcap capture to shorten file length?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 19 May 2008 11:43:16 -0700
Jake Peavy wrote:

or split,

If you mean the UN*X "split", note that you'd need one with an option such as "-b" that allows it to split binary files such as libpcap files, *and* that none of the resulting files will be readable except for the first, and that one will probably get an error when reading the last packet as it will almost certainly have been split. You'd have to have whoever's reading the file glue the files back together with "cat".