pcaps:ixmgtool
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
pcaps:ixmgtool [2019/04/13 19:16] – [Example run] veera | pcaps:ixmgtool [2019/04/15 16:48] – [How is it different from mergecap] veera | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ====== Merge multiple thin PCAP files into a single | + | ====== Merge multiple thin PCAP files into a single |
When you install Trisul Network Analytics , you get a free command line tool called '' | When you install Trisul Network Analytics , you get a free command line tool called '' | ||
Line 20: | Line 20: | ||
Mergecap | Mergecap | ||
- | trisul_ixmgtool when run with the squish option , aligns the timestamps | + | trisul_ixmgtool when run with the squish option , aligns the timestamps |
{{: | {{: | ||
+ | You can think of ixmgtool as combining the following three operations | ||
+ | - Find the lowest timestamp from all the pcap files, and compute the deltas for each file | ||
+ | - Run '' | ||
+ | - Run '' | ||
====== Using trisul_ixmgtool ====== | ====== Using trisul_ixmgtool ====== | ||
Line 49: | Line 53: | ||
===== Example run ===== | ===== Example run ===== | ||
- | Say you have put 10 files in a directory | + | Say you have put 10 files in a directory |
< | < | ||
Line 98: | Line 102: | ||
- | To get a **really FAT pcap** you can use the squish 10 option. This creates 10 dummy flows for each flow by manipulating the source IP to 10 different IPs in the 10.0.0.x range. | + | To get a **really FAT pcap** you can use the '' |
pcaps/ixmgtool.txt · Last modified: 2019/04/15 16:50 by veera