RE: Looking to split a 4 gig windump file

Hi Jack,
             I Tried the commands which you gave and it worked. It's very
useful for analyzing the traces. Thanks for sharing it with the list.

Regd's
Ritesh

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Jack McCarthy
Sent: Thursday, March 10, 2005 11:04 AM
To: Intrusions List (GCIA Practicals)
Subject: Re: [Intrusions] Looking to split a 4 gig windump file


Why off list?  Sounds like it's on topic to me and I'm sure we'd all like to
know the results...at least I would.

If you've already installed Ethereal, then you should have Editcap installed
too.
http://www.ethereal.com/docs/man-pages/editcap.1.html

Running this from a command line cuts a 593mb cap file down to 273mb - first
half of the file.

c:\> editcap -r infile outfile 1-300000


and this gives me the second half at 320mb.

c:\> editcap -r infile outfile 300001-900000


Adjust your numbers accordingly and it should work.


-jack


--- anthony reyes <[email protected]> wrote:
>
> Hi all,
>
> Im looking to split a 4Gig Windump file. I've tried
> several ways in both Linux & Windows with no success.
>
> I've used tcpsplit, split, ethereal, Iris, windump,
> tcpdump, snort, snortsnarf, acid, grep (painful) and
> several other ways. Any ideas. Please contact me off
> the list.
>
> Thanks,
>
> Anthony Reyes
>
>
>
> ---------------------------------
> Celebrate Yahoo!'s 10th Birthday!
>  Yahoo! Netrospective: 100 Moments of the Web
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
>


_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions