As much as
I like ethereal
it has a really annoying flaw; it only works on files less than 2 gigs
big. I've been dumping some NTP traffic for 2 months and have 18G
file to process, and tethereal complains
tethereal: The file "foo.pcap" could not be opened: Value too
large for defined data type.
I'm not patient enough to wade through the ethereal code to fix it, so
instead I wrote a quick and dirty Python script to split a pcap file
into 1 gig pieces: splitpcap.py.
Maybe someone will find this useful.
|