editcap adjust the time of specific frames

224 Views Asked by At

I have a .pcap file where I want to keep the timestamp of the first frame but adjust the time for every other frame. According to the man page it would seem that you can only adjust the time of every frame, not specific ones. Is there some way to split that allows for the alteration of specific, or at least a range of frames?

1

There are 1 best solutions below

0
On

I have a .pcap file where I want to keep the timestamp of the first frame but adjust the time for every other frame. Is there some way to split that allows for the alteration of specific, or at least a range of frames?

You would have to split the file into pieces, each of which contains frames whose time stamps should all be adjusted in the same fashion, perform the adjustments on the individual files, and then put the pieces back together in order.

For "every other frame", this means splitting the file into one-packet files, adjusting the time stamp in all the even-numbered files, and then putting them back together.