diff options
| author | Gerald Combs <gerald@wireshark.org> | 2010-02-17 20:15:50 +0000 |
|---|---|---|
| committer | Gerald Combs <gerald@wireshark.org> | 2010-02-17 20:15:50 +0000 |
| commit | 23a90258fb4d78610037b83d6d55154a347284ed (patch) | |
| tree | 37f2cbe38257ffd515968843b12047bdfd228beb /doc/mergecap.pod | |
| parent | 088cddca99bd8f2ed8c5a0cc0d5dd4457a27b548 (diff) | |
| download | wireshark-23a90258fb4d78610037b83d6d55154a347284ed.tar.gz | |
Add an option to capinfos to print start and end times as seconds, which
makes time-shifting using editcap easier. Sort the flags in the capinfos
man page alphabetically to match the other man pages. Add a
time-shifting example to the mergecap man page.
svn path=/trunk/; revision=31905
Diffstat (limited to 'doc/mergecap.pod')
| -rw-r--r-- | doc/mergecap.pod | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/doc/mergecap.pod b/doc/mergecap.pod index 5e8ab45448..b842584ba4 100644 --- a/doc/mergecap.pod +++ b/doc/mergecap.pod @@ -119,6 +119,21 @@ fddi>' is specified). =back +=head1 EXAMPLES + +To merge two capture files together, 100 seconds apart use: + + capinfos -aeS a.pcap b.pcap + +(Let's suppose a.pcap starts at 1009932757 and b.pcap ends +at 873660281. 1009932757 - 873660281 - 100 = 136272376 +seconds.) + + editcap -t 136272376 b.pcap b-shifted.pcap + mergecap -w compare.pcap a.pcap b-shifted.pcap + +=back + =head1 SEE ALSO tcpdump(8), pcap(3), wireshark(1), tshark(1), dumpcap(1), editcap(1), |