editcap

Extract packets by range

$ editcap -r [input.pcap] [output.pcap] [1-100]

$ editcap -d [input.pcap] [output.pcap]

$ editcap -c [1000] [input.pcap] [output.pcap]

$ editcap -i [60] [input.pcap] [output.pcap]

$ editcap -F [pcapng] [input.pcap] [output.pcapng]

$ editcap -s [128] [input.pcap] [output.pcap]

editcap [options] infile outfile [packetrange_]

editcap is a packet capture file editor from the Wireshark suite. It reads capture files and writes portions or modified versions to new files, supporting format conversion, packet selection, and time adjustments.
Common uses include splitting large captures, removing duplicates, extracting time ranges, and converting between capture formats like pcap and pcapng.

-r range

Keep only packets in range.

Remove duplicate packets.

Duplicate window (default 5).

Split into files of count packets.

Split by time interval.

Output file format.

Truncate packets to length.

Adjust timestamps.

Set start time.

Keep packets after time.

Keep packets before time.

Set encapsulation type.

Does not modify original file. Some operations load entire file into memory. Packet ranges are 1-based. Format conversion may lose metadata. Part of Wireshark; requires wireshark or tshark packages.

editcap is part of the Wireshark project, originally Ethereal, created by Gerald Combs in 1998. It provides command-line capture file manipulation complementing the graphical Wireshark analyzer.

wireshark(1), tshark(1), mergecap(1), capinfos(1)