THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

How to get random packets from a .pcap file?

I am trying to get a random subset of packets from a .pcap file. To do so, I have written the following shell script:

large_number=150000
smaller_number=10000
selected_packet_numbers=$(shuf -i 0-"$large_number" -n "$smaller_number")
editcap -r capture.pcap capture-selected.pcap $selected_packet_numbers

However, editcap is giving me the following error:

Out of room for packet selections

Using a shell loop would take an unreasonably long time.

What can I do to select a random subset of packets from a .pcap file?

Utku's avatar
1
Utku
asked 2017-11-02 03:13:07 +0000, updated 2017-11-02 03:45:56 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

Unless something has changed, there will be a limit to the number of packets or ranges you can specify in a single run of editcap https://www.wireshark.org/lists/wires... (it might be still 100 or could have been increased to 512)

So you might need to work with that.

martyvis's avatar
911
martyvis
answered 2017-11-02 05:05:53 +0000
edit flag offensive 0 remove flag delete link
more

Comments

1

In Wireshark 2.x this is set to 512.

Jaap's avatar Jaap (2017-11-02 06:49:48 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer