By default, Mergecap writes the capture file in pcapng format, and writes all of the packets from the input capture files to the output file.
Mergecap is able to detect, read and write the same capture files that are supported by Wireshark. The input files don't need a specific filename extension; the file format and an optional gzip compression will be automatically detected. Near the beginning of the DESCRIPTION section of wireshark(1) or <https://www.wireshark.org/docs/man-pages/wireshark.html> is a detailed description of the way Wireshark handles this, which is the same way Mergecap handles this.
Mergecap can write the file in several output formats. The -F flag can be used to specify the format in which to write the capture file, mergecap -F provides a list of the available output formats.
Packets from the input files are merged in chronological order based on each frame's timestamp, unless the -a flag is specified. Mergecap assumes that frames within a single capture file are already stored in chronological order. When the -a flag is specified, packets are copied directly from each input file to the output file, independent of each frame's timestamp.
The output file frame encapsulation type is set to the type of the input files if all input files have the same type. If not all of the input files have the same frame encapsulation type, the output file type is set to WTAP_ENCAP_PER_PACKET. Note that some capture file formats, most notably pcap, do not currently support WTAP_ENCAP_PER_PACKET. This combination will cause the output file creation to fail.
Note: when merging, mergecap assumes that packets within a capture file are already in chronological order.
Every input file has one or more IDBs, which describe the interface(s) the capture was performed on originally. This includes encapsulation type, interface name, etc. When mergecap merges multiple input files, it has to merge these IDBs somehow for the new merged output file. This flag controls how that is accomplished. The currently available modes are:
Note that an IDB is only considered a matching duplicate if it has the same encapsulation type, name, speed, time precision, comments, description, etc.
capinfos -aeS a.pcap b.pcap
(Let's suppose a.pcap starts at 1009932757 and b.pcap ends at 873660281. 1009932757 - 873660281 - 100 = 136272376 seconds.)
editcap -t 136272376 b.pcap b-shifted.pcap mergecap -w compare.pcap a.pcap b-shifted.pcap
Mergecap is part of the Wireshark distribution. The latest version of Wireshark can be found at <https://www.wireshark.org>.
HTML versions of the Wireshark project man pages are available at: <https://www.wireshark.org/docs/man-pages>.
Original Author -------- ------ Scott Renfro <scott[AT]renfro.org> Contributors ------------ Bill Guyton <guyton[AT]bguyton.com>