Wireshark / Tshark pcap重新组装代码

Question

有人知道在tshark或wireshark中我可以用来重新组装pcap文件的代码吗？我正在开发一个应用程序，需要重新组装pcap文件，但不需要wireshark / tshark的其他功能......所以，希望以此为指导。

感谢。

Answer 1

If it's tcpdump file (not ng format), you can throw away the first 24 bytes (file header) of the second file and concatenate the rest to the first file, then you do the same for all the other files.

Answer 2

mergecap（来自wireshark套件）将合并两个或多个pcap文件。