2

I have a pcap file which contains tcp traces.

I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis.

For example, if into my network I have ip addresses which belong to 192.168.0.0/16, I want to divide the traces in two pcaps: the first with ip from 192.168.0.0 to 192.168.127.127 and the second from 192.160.127.128 to 192.168.255.255.

At the same time, I don't want to lose tcp connections towards external servers.

Can Wireshark do this?

1 Answer 1

2

I suggest using PcapSplitter which is part of PcapPlusPlus suite. You can compile its code yourself or download binaries for several platform from here

The you can use the tool to achieve what you want as following:

PcapSplitter.exe -f your_file.pcap -i "net 192.168.0.0 mask 255.255.128.0" -m client-ip -o <PATH_TO_OUTPUT_DIR1>

PcapSplitter.exe -f your_file.pcap -i "net 192.168.128.0 mask 255.255.128.0" -m client-ip -o <PATH_TO_OUTPUT_DIR2>

Each run will output a folder containing pcap files per client IP - the first folder for client IPs ranging from 192.168.0.0 to 192.168.127.255 and the other folder for client IPs ranging from 192.168.128.0 to 192.168.255.255. Then you can use mergecap or other tool to merge the pcap files in each folder if you want

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .