Opened 14 years ago

Last modified 14 years ago

#30 new enhancement

tracesplit should be able to split by tcp connection

Reported by: matt@… Owned by: perry
Priority: minor Milestone: libtrace3
Component: tools Version: 3.0
Keywords: Cc:

Description

I would like to be able to use the tracesplit utlity to split a large trace into a series of smaller traces where each smaller traces contains a single tcp connection.

I imagine in the case of incomplete connections they could simply be thrown away when using this option.

The UI might be something like

tracesplit pcap:bigtrace.pcap -t smalltrace

Change History (1)

comment:1 Changed 14 years ago by perry

I'd just split by 5 tuple rather than by TCP connection. This would mean incomplete connections would end up in their own file.

Note: See TracTickets for help on using tickets.