pcap file help

I have a large pcap file, and I need to extract the 39th and 40th
packets. Is there a good utility to do just that?

Thanks.

jly <(E-Mail Removed)> wrote:
> I have a large pcap file, and I need to extract the 39th and 40th
> packets. Is there a good utility to do just that?

In ethereal, you can mark packets (right click on the packet). You can
then use save-as to save just the marked packets.

If you wanted to split by time, you could use tcpslice. Not sure if it
also deals with selecting individual packets.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!