tcpslice
tcpslice
tcpslice [options] [start [end] ] files
System administration command. Reads and manipulates packet capture files created by tcpdump -w. Based on timestamps, extract portions of or piece together files. Display all packets between the given start and end times. tcpslice understands most time and date formats. tcpslice also understands a relative time format specified as a unit of time—e.g., +1h10m to specify the first hour and ten minutes of packets in the specified files. This format is named ymdhmsu after the letters it uses to denote units of time: years, months, days, hours, minutes, seconds, and microseconds. If no constraining dates are specified, the command will print out all packets contained in files.
Options
Print the start and end time of the specified range, then exit.
Print the time and date of the first and last packet in each file, then exit.
Print the raw timestamp of the first and last packet in each file, then exit.
Print times associated with the first and last packet in each file in ymdhmsu format.
Write output to file instead of standard output.