Opened 10 years ago

#383 new defect

split pcap into many pcap's based on flows/sessions/hosts/etc

Reported by: aturner Owned by: aturner
Priority: medium Milestone: Future Release
Component: tcpprep Version: 3.4.1
Keywords: Cc:
Operating System: Add to FAQ?: no
Hardware: All
Output of tcpreplay -V:

Description

If I have a large pcap containing many flows/sessions or communications between hosts, end users often want to split this pcap into multiple pcaps each containing a single flow or session. Sorta like a tcpflow, but without doing reassembly and dumping data streams

Change History (0)

Note: See TracTickets for help on using tickets.