Merge Multiple Capture Files using mergecap

Introduction

In network analysis and security forensics, you often end up with multiple packet capture files. These might be from different time periods, different network interfaces, or different machines. Analyzing them separately can be cumbersome and may prevent you from seeing the complete picture of a network event.

mergecap is a command-line tool that comes with the Wireshark suite. Its specific purpose is to combine multiple capture files into a single output file. It intelligently merges the packets from the input files in chronological order based on their timestamps, creating a unified view for analysis.

In this lab, you will learn how to use mergecap to merge several sample capture files.

Identify Multiple .cap Files from Different Scans

In this step, you will identify the sample capture files that have been prepared for you in the lab environment. For a real-world scenario, these files might have been generated by running tcpdump or Wireshark at different times.

Our setup script has already created three files: scan1.pcap, scan2.pcap, and scan3.pcap. Let's list the contents of the current directory to see them. All your work will be done in the ~/project directory.

Use the ls -l command to list the files with details:

ls -l

You should see an output similar to the following, confirming the presence of our three capture files. The sizes and timestamps may vary slightly.

total 12
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan1.pcap
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan2.pcap
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan3.pcap

These three .pcap files represent the different data sources we want to combine.

Understand Why Merging Files is Useful for Analysis

In this step, we will discuss the benefits of merging capture files. There are no commands to execute here; this section is for conceptual understanding.

When you are investigating a network issue or a security incident, having all relevant data in one place is crucial. Here’s why merging is so useful:

1. Chronological Analysis: mergecap automatically sorts packets from all input files by their timestamp. This allows you to reconstruct a single, chronological timeline of events, which is essential for understanding cause and effect.
2. Simplified Workflow: Instead of opening three separate files in Wireshark and constantly switching between them, you can work with a single, consolidated file. This makes filtering, searching, and analyzing data much more efficient.
3. Comprehensive View: Imagine you captured traffic on a client machine and a server simultaneously. Merging these two captures allows you to see both sides of the conversation in one stream, providing a complete picture of the interaction.

By merging files, you transform fragmented data into a coherent and analyzable whole.

Use the mergecap Command from the Wireshark Suite

In this step, you will get acquainted with the mergecap command itself. The setup script has already installed the tshark package, which includes the mergecap utility.

To ensure mergecap is available and to see its basic usage instructions, you can view its help page. This is a good practice to understand the capabilities of any command-line tool.

Run the mergecap command with the -h (help) flag:

mergecap -h

This will display a list of all available options and their descriptions. The output will look something like this:

Mergecap (Wireshark) 4.0.x
Merge two or more capture files into one.
See https://www.wireshark.org for more information.

Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]

Output:
  -w <outfile>|-      set the output filename to <outfile> or '-' for stdout
  -a                  append packets to the end of the output file
...

Pay close attention to the -w <outfile> option. This is the most important flag, as it tells mergecap where to save the combined output.

Specify the Output File with -w and All Input Files

In this step, you will perform the actual merge operation. The syntax is straightforward: you specify the output file with -w and then list all the input files you want to merge.

We will combine scan1.pcap, scan2.pcap, and scan3.pcap into a single new file named merged_scans.pcap.

Execute the following command in your terminal:

mergecap -w merged_scans.pcap scan1.pcap scan2.pcap scan3.pcap

The command will not produce any output if it succeeds. To confirm that the new file was created, list the files in the directory again:

ls -l

You should now see the merged_scans.pcap file in the list. Its size should be roughly the sum of the three input files.

total 16
-rw-r--r-- 1 labex labex 208 Oct 26 10:35 merged_scans.pcap
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan1.pcap
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan2.pcap
-rw-r--r-- 1 labex labex 160 Oct 26 10:30 scan3.pcap

You have successfully merged the three source files into one.

Verify the Merged File Contains Data from All Sources

In this step, you will verify that the merged file actually contains the combined data from all source files. A simple way to do this is to check the number of packets in the original files and compare it to the number of packets in the merged file.

The capinfos tool, also part of the Wireshark suite, provides summary statistics for capture files. First, let's check the packet count for one of the original files:

capinfos scan1.pcap

The output will show various details about the file. Look for the "Number of packets" line.

File name:           scan1.pcap
File type:           pcapng
...
Number of packets:   5
...

As you can see, scan1.pcap contains 5 packets. Since we created all three source files with 5 packets each, the merged file should contain a total of 15 packets.

Now, run capinfos on the merged file:

capinfos merged_scans.pcap

Check the packet count in the output:

File name:           merged_scans.pcap
File type:           pcapng
...
Number of packets:   15
...

The "Number of packets" is 15, which confirms that the data from all three source files has been successfully combined into merged_scans.pcap.

Summary

In this lab, you have learned a fundamental skill for network traffic analysis. You started by identifying multiple, separate packet capture files. You then learned the core syntax of the mergecap command and used it to combine the separate files into a single, unified capture file. Finally, you used the capinfos utility to verify that the merge was successful by confirming that the total number of packets in the new file matched the sum of the packets from the source files.

You are now equipped to consolidate network captures from various sources, which will significantly streamline your analysis workflow.