tracesplit should be able to split by tcp connection

[matt@…]

I would like to be able to use the tracesplit utlity to split a large trace into a series of smaller traces where each smaller traces contains a single tcp connection.

I imagine in the case of incomplete connections they could simply be thrown away when using this option.

The UI might be something like

tracesplit pcap:bigtrace.pcap -t smalltrace

[perry]

I'd just split by 5 tuple rather than by TCP connection. This would mean incomplete connections would end up in their own file.