Printer FriendlyEmail Article Link

Wireshark: How can I select only a few packets out of a .pcap file and save it off in a new .pcap file?

Objective/Summary
  • This article will describe method to create a new .pcap file with just a select few packets from a .pcap file of many packets.
    • This may be useful to prepare a file to be imported into Spirent TestCenter's Generate Stream Block feature (aka Capture Replay)
Environment/Versions
  • Wireshark
Procedure
  • Launch Wireshark
  • Open the original .pcap from which you want to select the packets from
  • File -> Expot Specified Packets...
  • Packet Range -> Range: -> enter the range of packets
    • For example for packets:
      • 1 through 10:  enter "1-10"
      • 1, 5, and 10:  enter "1,5,10"

Product : Packet Captures