The component can be specified to nine (9) decimal places (billionths of a second) but most typical trace files have resolution to six (6) decimal places (millionths of a second). The duplicate comparison test stops when the current packet's relative arrival time is greater than.

If the packet's relative arrival time is less than or equal to the of a previous packet and the packet length and MD5 hash of the current packet are the same then the packet to skipped. The current packet's arrival time is compared with up to 1000000 previous packets. NOTE: Specifying large values with large tracefiles can result in very long processing times for editcap. The is specifed as an integer value between 000 (inclusive). This verbose output (specifically the MD5 hash strings) can be useful in scripts to identify duplicate packets across trace files. The use of the option -D 0 combined with the -v option is useful in that each packet's Packet number, Len and MD5 Hash will be printed to standard out. If a match is found, the current packet is skipped. The length and MD5 hash of the current packet are compared to the previous - 1 packets. This option is equivalent to using the option -D 5. The length and MD5 hash of the current packet are compared to the previous four (4) packets. This is useful in the rare case that the conversion between two file formats leaves some random bytes at the end of each packet. Each packet is chopped at the packet end by a few bytes of data. Sets the chop length to use when writing the packet data. The default is to use a single output file.

If the specified number of packets is written to the output file, the next output file is opened. Each output file will be created with a suffix -nnnnn, starting with 00000. Splits the packet output to different files based on uniform packet counts with a maximum of each.

Editcap examples