DESCRIPTION

Mergecap is a program that combines multiple saved capture files into a single output file specified by the -w argument. Mergecap knows how to read pcap and pcapng capture files, including those of tcpdump, Wireshark and other tools that write captures in those formats.

By default, Mergecap writes the capture file in pcapng format, and writes all of the packets from the input capture files to the output file.

Mergecap is able to detect, read and write the same capture files that are supported by Wireshark. The input files don’t need a specific filename extension; the file format and an optional gzip, zstd or lz4 compression will be automatically detected. Near the beginning of the DESCRIPTION section of wireshark(1) or https://www.wireshark.org/docs/man-pages/wireshark.html is a detailed description of the way Wireshark handles this, which is the same way Mergecap handles this.

Mergecap can write the file in several output formats. The -F flag can be used to specify the format in which to write the capture file, mergecap -F provides a list of the available output formats.

Packets from the input files are merged in chronological order based on each frame’s timestamp, unless the -a flag is specified. Mergecap assumes that frames within a single capture file are already stored in chronological order. When the -a flag is specified, packets are copied directly from each input file to the output file, independent of each frame’s timestamp.

The output file frame encapsulation type is set to the type of the input files if all input files have the same type. If not all of the input files have the same frame encapsulation type, the output file type is set to WTAP_ENCAP_PER_PACKET. Note that some capture file formats, most notably pcap, do not currently support WTAP_ENCAP_PER_PACKET. This combination will cause the output file creation to fail.


https://www.wireshark.org/docs/man-pages/mergecap.html