[Bro] how to merge pcap files?

Vern Paxson vern at icir.org
Tue Nov 11 22:39:51 PST 2008


[excessive addresses trimmed]

> how to merge pcap files saved by -w option?

The best tool for this is ipsumdump:

	ipsumdump --collate -w output.trace input1.trace input2.trace ...

You can get it from http://www.cs.ucla.edu/~kohler/ipsumdump/ .

		Vern



More information about the Bro mailing list