How to read multiple pcap files >2GB?

Question

I am trying to parse large pcap files with libpcap but there is a file limitation so my files are separated at 2gb. I have 10 files of 2gb and I want to parse them at one shot. Is there a possibility to feed this data on an interface sequentially (each file separately) so that libpcap can parse them on the same run?

Answer 1

I am not aware of any tools that will allow you to replay more than one file at a time.

However, if you have the disk space, you can use mergecap to merge the ten files into a single file and then replay that.

Mergecap supports merging the packets according to

1. chronological order of each packet's timestamp in each file
2. ignoring the timestamps and performing what amounts to a packet version of 'cat'; write the contents of the first file to the output, then the next input file, then the next.

Mergecap is part of the Wireshark distribution.