How to : Edit large wireshark files with “editcap”

Wireshark does not play well with large pcap files. I read somewhere you need 1GB of RAM for 1 GB of file.

I recently needed to review the contents of a 30gb pcap file and wireshark refused to open it.

Few minutes of googling and i came accross this useful command

editcap. Its part of wire shark, located in the installation directory

editcap -h will give you some useful information

I found this post useful

Here is my example for extracting one days worth of capture

“C:\progam files\wireshark\editcap.exe” -v -A “2019-30-11 08:00:00” -B “2019-11-30 18:00:00” c:\input.pcap d:\output.pcap

How to find the oldest file in a certian location

I wanted to find the oldest recording on the local hardrive.

I had a Mitel call recorder (MIVCR) which had started deleting recording due to an error and i wanted to find out the oldest recording left on the recording drive

I could use the MIVCR software but that only shows you the oldest in SQL not the oldest on the hardrive (they maybe the same)

Continue reading

How to use screened transfer on the nupoint


Recently i can across my first customer using “screened transfer”. The facility had stopped working correctly after an upgrade.

The calls were being transferred but no questions were being asked of the caller and the receiver of the call was not being asked if they would like to take the call.


After further upgrades and checks i was told that i should check the supervised transfer settings. It needs to be s+xg

screened transfer








screened transfer 2