Revision history [back]
The reason you can't run mergecap from you capture directory is because the Wireshark program is not in your path. Wireshark's installation doesn't add itself to the path. I am assuming you are using Windows. There are two options:
- type c:"\program files\wireshark\mergecap", the double quotes is because the space in "program files"
- Update the Windows path. Go to the Windows "Advanced System Settings", "Environmental Variables", "User variables, click "path", and then edit. Add the folder that Wireshark folder, e.g. "c:\Program Files\Wireshark\", closed all the windows and then restart. Mergecap can run from any folder.
Merging files from different folders I just tested this with Windows 10. I created c:\temp2, c:\temp3, and c:\temp4 folders. I copied one pcap to c:\temp3 folder and different pcap to c:\temp4 folder. Then from c:\temp2, I merged the two pcaps together. You will need to use the full path name for the file names, e.g. c:\temp3\test.pcap.
The reason you can't run mergecap from you capture directory is because the Wireshark program is not in your path. Wireshark's installation doesn't add itself to the path. I am assuming you are using Windows. There are two options:
- options:
1. type c:"\program files\wireshark\mergecap", the double quotes is because the space in "program
files" - files"
2. Update the Windows path. Go to the Windows "Advanced System Settings", "Environmental Variables", "User variables, click "path", and then edit. Add the folder that Wireshark folder, e.g. "c:\Program Files\Wireshark\", closed all the windows and then restart. Mergecap can run from any folder.
Merging files from different folders I just tested this with Windows 10. I created c:\temp2, c:\temp3, and c:\temp4 folders. I copied one pcap to c:\temp3 folder and different pcap to c:\temp4 folder. Then from c:\temp2, I merged the two pcaps together. You will need to use the full path name for the file names, e.g. c:\temp3\test.pcap.