On Oct 13, 2018, at 3:29 PM, Assaf <assaf.morami@xxxxxxxxx> wrote:
> I wrote joincap ( https://github.com/assafmo/joincap ), a mergecap alternative, because I believe mergecap and tcpslice doesn't handle errors the best way possible while merging pcap files.
"Errors" here meaning
1) an input file is damaged;
2) an input file doesn't exist;
3) an input file is a directory.
"The best way possible" is probably a matter of personal preference; if you prefer what I assume is "ignore the file" to "report an error and quit" for cases 2) and 3), then joincap handles those errors in "the best way possible", but if you prefer to treat it as an error, mergecap handles it in "the best way possible". As for 1), that's also a matter of preference.
> I hope this tools will help some of you. ☺
You might want to add it to the Tools page on the Wireshark Wiki:
https://wiki.wireshark.org/Tools