Quick question, let's say you have 150M pcap dump file. What console tool would you
use to split it up in half?

thanks in advance,
cg

If you want to split a file into pieces, the command you want to use is called, guess what, split. You could use the option -b 75m for two 75 Mb files, However you may want to use the -l lines option so you don't split lines between files. Using the 'wc -l' command could tell you how many lines are in the log file.

Hehe, that's funny! Here I am a LPI graduate, and you push me into split and wc! lol
The tests test this, lol, past funny. Anyways, no, split doesn't work, either with a common
pcap file or one with wireless headers. Go ahead, run kismet and do a split on a pcap dump,
then open it up with tethereal and let me know what ya get, file 1 is good, 2 is bunk; same results
with wired frames. That's my network though, maybe your's different?

Any other idears?

bests, thanks again for the laugh, I remember studying my butt off, only to pass with colors, split, wc - giggle...
what's next, fmt, hahahahaha lol. Joking. Had to be there.
cg

I thought that you wanted to break up the file into pieces to reassemble later with cat.

Look at the tcpslice program.

Thanks found this too.

http://freshmeat.net/projects/pcapmerge/

It was right under my nose the entire time Kinda like forgetting
to quote a variable again...

Sounding off, thanks again,
cg