Freigeben über

Chained Captures and Stitching Them Back Together

  • Artikel

When you use NMCap to capture data you have an option to save the capture files as a chain. As the current capture file format has a limited size, this option allows you to continually capture the data in successive files. This also gives you some flexibility to limit the size. If you are sending files to another person for analysis you could send only the files that relate to the time period where a problem occurred. After using this feature; however, it might be useful to filter and re-stitch these capture files back together.

Capturing Chained Files with NMCap

You can capture using chained files using NMCap by naming the file with a .chn extension. The resulting files are named .cap, but they'll be a "capfile(#).cap" for every chained capture file after the first one. So for instance using the following command:

NMCap /network * /capture ipv4.address==1.2.3.4 /file foo.chn:1M

Will produce capture files which are 1 meg in size and have the following names in this order: foo.cap, foo(1).cap, foo(2).cap and so on. I've also provided a capture filter to limit the traffic to just one address. However, for the best performance I would leave any filtering out.

Combining Captures with NMCap

Using NMCap, you can recombine these to create one large capture file. To do this use the /InputCapture option as follows:

NMCap /InputCapture foo.cap foo(1).cap foo(2).cap /Capture /File out.cap

You could additionally add a filter to limit the information that gets transferred. For instance, say I only wanted to see port 80 traffic in the resulting trace. In that case the following NMCap will get the job done.

NMCap /InputCapture foo.cap foo(1).cap foo(2).cap /Capture tcp.port==80 /File out.cap

Using a Script to Combine Many Capture Files

Now, this might get somewhat tedious the more files you have. We can solve this problem by using a simple CMD Script to create collect all the files for us. Just create a file using notepad called stitch.CMD and place in it these contents:

 setlocal enabledelayedexpansionREM Usage: stitch InCapFileBaseName OutCapFile.cap [Filter]
REM Creates flat output of capture files by date
dir /b /od %1*.cap > %TEMP%\captures.txt

REM Stores ordered file list in environment variable
SET INCAP=/InputCapture
for /f %%c in (%TEMP%\captures.txt) do call :addCap %%c

REM Calls NMCap to combine files
NMCap %INCAP% /capture "%3" /file %2.chn:500M
goto :eof

REM Routine to append a file to the environment variable
:addCap
SET INCAP=%INCAP% %1

goto :eof

[Note: Fixed script and removed extraneous text]

The CMD script file takes three parameters; the first is the original file name without the .cap extension. The second is the output capture file. Add the 3rd is the filter which is optional. You'll also want to run the script in the directory where all your captures are. Since it searches for *.cap, make sure there aren't any extraneous captures.

Comments

  • Anonymous
    January 01, 2003
    thanks
  • Anonymous
    February 11, 2015
    ¡Hola de nuevo! ¿Echabais de menos a Network Monitor? ¿Os supo a poco el anterior
  • Anonymous
    February 11, 2015
    ¡Hola de nuevo! ¿Echabais de menos a Network Monitor? ¿Os supo a poco el anterior