On Wed, Feb 12, 2003 at 09:01:54AM -0300, Hilario Rosenzweig wrote:
> Helo all Ethereal gurus, I'd like to know if its possible to use any
> sort of postfitering to limit the sisze of the packet alredy captured to
> lower the captured file size.
What do you mean by "postfiltering"?
If you mean that you have a capture file and you want to make a new
capture file that has the same packets but that limits them to a maximum
of N bytes, just as if the capture had been done with a snapshot length
of N, then you can use the editcap utility to read the capture file and
write out a new file:
editcap -s N oldfile newfile
which will read the capture file "oldfile" and write out a new capture
file "newfile"; packets in "newfile" will be truncated, if necessary, so
that no more than N bytes of packet data are present.
