mergecap命令批量合并pcap
使用linux shell脚本,把多个文件夹中的多个pcap合并为每个文件夹对应一个pcap# **********a.sh************#!/bin/bashoutputPcap="outputDir"rm -rf $outputPcapmkdir $outputPcapecho "输出文件夹:"$outputPcapmy_array=(`ls -l | grep ^d | tail
acat@acat-xx:~$ mergecap --help
Mergecap (Wireshark) 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu18.04.0)
Merge two or more capture files into one.
See https://www.wireshark.org for more information.
Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]
Output:
-a concatenate rather than merge files.
default is to merge based on frame timestamps.
-s <snaplen> truncate packets to <snaplen> bytes of data.
-w <outfile>|- set the output filename to <outfile> or '-' for stdout.
-F <capture type> set the output file type; default is pcapng.
an empty "-F" option will list the file types.
-I <IDB merge mode> set the merge mode for Interface Description Blocks; default is 'all'.
an empty "-I" option will list the merge modes.
Miscellaneous:
-h display this help and exit.
-v verbose output.
-F参数指定输出文件的格式,默认输出pcapng格式的,也可以输出其他格式。
<pre><font color="#8AE234"><b>acat@acat-xx</b></font>:<font color="#729FCF"><b>~</b></font>$ mergecap -F
mergecap: option requires an argument -- 'F'
mergecap: The available capture file types for the "-F" flag are:
5views - InfoVista 5View capture
btsnoop - Symbian OS btsnoop
commview - TamoSoft CommView
dct2000 - Catapult DCT2000 trace (.out format)
erf - Endace ERF capture
eyesdn - EyeSDN USB S0/E1 ISDN trace format
k12text - K12 text file
lanalyzer - Novell LANalyzer
logcat - Android Logcat Binary format
logcat-brief - Android Logcat Brief text format
logcat-long - Android Logcat Long text format
logcat-process - Android Logcat Process text format
logcat-tag - Android Logcat Tag text format
logcat-thread - Android Logcat Thread text format
logcat-threadtime - Android Logcat Threadtime text format
logcat-time - Android Logcat Time text format
modpcap - Modified tcpdump - pcap
netmon1 - Microsoft NetMon 1.x
netmon2 - Microsoft NetMon 2.x
nettl - HP-UX nettl trace
ngsniffer - Sniffer (DOS)
ngwsniffer_1_1 - NetXray, Sniffer (Windows) 1.1
ngwsniffer_2_0 - Sniffer (Windows) 2.00x
niobserver - Network Instruments Observer
nokiapcap - Nokia tcpdump - pcap
nsecpcap - Wireshark/tcpdump/... - nanosecond pcap
nstrace10 - NetScaler Trace (Version 1.0)
nstrace20 - NetScaler Trace (Version 2.0)
nstrace30 - NetScaler Trace (Version 3.0)
nstrace35 - NetScaler Trace (Version 3.5)
pcap - Wireshark/tcpdump/... - pcap
pcapng - Wireshark/... - pcapng
rf5 - Tektronix K12xx 32-bit .rf5 format
rh6_1pcap - RedHat 6.1 tcpdump - pcap
snoop - Sun snoop
suse6_3pcap - SuSE 6.3 tcpdump - pcap
visual - Visual Networks traffic capture
<font color="#8AE234"><b>acat@acat-xx</b></font>:<font color="#729FCF"><b>~</b></font>$
</pre>
使用linux shell脚本,把多个文件夹中的多个pcap合并为每个文件夹对应一个pcap
# ********** a.sh ************ #!/bin/bash outputPcap="outputDir" rm -rf $outputPcap mkdir $outputPcap echo "输出文件夹:"$outputPcap my_array=(`ls -l | grep ^d | tail -n+1 | awk -F ' ' '{print $NF}'`) for i in ${my_array[@]} do cd ${i} echo "文件夹:${i}" outPcapName=${i}_.pcap echo $outPcapName mergecap -w ../${outputPcap}/${outPcapName} `ls | grep .*.pcap` &#让该命令在后台执行 # ls | grep .*.pcap cd .. done
更多推荐
所有评论(0)