Abhik Sarkar wrote:
Or, if you are in a *nix environment (or have Cygwin on Windows), with
a bit of scripting, you can do the following:
use capinfos to get the number of packets in the file:
$ capinfos -c test.cap
File name: test.cap
Number of packets: 8802
Then use something like:
$ editcap -r test.cap extract.cap 7803-8802
Then, extract.cap will have the last 1000 packets!
This method is longer than what Hansang suggested, but will result in
exactly one file which is of interest to you ;-)
Very true! And you never know, the "final" file could have just 800
packets it in, so this is a better approach.
--
Thanks,
Hansang