{"repo":"assafmo/joincap","free":true,"listed":false,"github":"https://github.com/assafmo/joincap","clone":"git clone https://github.com/assafmo/joincap.git","description":"Merge multiple pcap files together, gracefully.","language":"Go","stars":219,"topics":["pcap","merge","tcpdump-capture","packet-processing","network","pcap-files","command-line","pcap-processor","commandline","concat"],"license":"MIT","category":"cli-tools","readme_excerpt":"joincap Merge multiple pcap files together, gracefully. Installation - Download a precompiled binary from https://github.com/assafmo/joincap/releases - Or... Use go get : - Or use Ubuntu PPA: Basic Usage Why? I believe skipping corrupt packets is better than failing the entire merge job. When using tcpslice or mergecap sometimes pcapfix is needed to fix bad input pcap files. 1. One option is to try and run merge ( mergecap / tcpslice ), if we get errors then run pcapfix on the bad pcaps and then run merge again. - Adds complexity (run - check errors - fix - rerun) - (If errors) Demands more resources ( pcapfix processes) - (If errors) Extends the total run time 2. Another option is to run pcapfix on the input pcap files and then merge. - Extends the total run time by a lot (read and write each pcap twice instead of once) - Demands more storage (for the fixed pcaps) - Demands more resources ( pcapfix processes) 3. We can use pcapfix \"in memory\" with process substitution: mergecap -w out.pcap (last packet data is truncated) :heavy check mark: :heavy check mark: :heavy check mark: Input pcap has no packets (global header is ok, no first packet header) :heavy check mark: :heavy check mark: :x: Input file size is smaller than 24 bytes (global header is truncated) :heavy check mark: :heavy check mark: :x: Input file size is between 24 and 40 bytes (global header is ok, first packet header is truncated) :heavy check mark: :x: :x: Input file doesn't exists :heavy check mark: :x: :x: ","default_branch":null,"files":null,"tree":[],"storefront":"/r/assafmo","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/assafmo/joincap/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}