How to : Edit large wireshark files with “editcap”

Wireshark does not play well with large pcap files. I read somewhere you need 1GB of RAM for 1 GB of file.

I recently needed to review the contents of a 30gb pcap file and wireshark refused to open it.

Few minutes of googling and i came accross this useful command

editcap. Its part of wire shark, located in the installation directory

editcap -h will give you some useful information

Here is my example for extracting one days worth of capture

“C:\progam files\wireshark\editcap.exe” -v -A “2019-30-11 08:00:00” -B “2019-11-30 18:00:00” c:\input.pcap d:\output.pcap