| Current File : //usr/share/wireshark/reordercap.html |
<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>reordercap - The Wireshark Network Analyzer 2.0.3</title>
<link rel="stylesheet" href="/builds/ul11u3sru-gate/components/wireshark/wireshark-2.0.3/docbook/ws.css" type="text/css" />
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:perl@solaris-userland.java.net" />
</head>
<body>
<!-- INDEX BEGIN -->
<div name="index">
<p><a name="__index__"></a></p>
<!--
<ul>
<li><a href="#name">NAME</a></li>
<li><a href="#synopsis">SYNOPSIS</a></li>
<li><a href="#description">DESCRIPTION</a></li>
<li><a href="#options">OPTIONS</a></li>
<li><a href="#see_also">SEE ALSO</a></li>
<li><a href="#notes">NOTES</a></li>
<li><a href="#authors">AUTHORS</a></li>
</ul>
-->
</div>
<!-- INDEX END -->
<p>
</p>
<h1><a name="name">NAME</a></h1>
<p>reordercap - Reorder input file by timestamp into output file</p>
<p>
</p>
<hr />
<h1><a name="synopsis">SYNOPSIS</a></h1>
<p><strong>reordercap</strong>
[ <strong>-n</strong> ]
[ <strong>-v</strong> ]
<<em>infile</em>> <<em>outfile</em>></p>
<p>
</p>
<hr />
<h1><a name="description">DESCRIPTION</a></h1>
<p><strong>Reordercap</strong> is a program that reads an input capture file and rewrites the
frames to an output capture file, but with the frames sorted by increasing
timestamp.</p>
<p>This functionality may be useful when capture files have been created by
combining frames from more than one well-synchronised source, but the
frames have not been combined in strict time order.</p>
<p><strong>Reordercap</strong> writes the output capture file in the same format as the input
capture file.</p>
<p><strong>Reordercap</strong> is able to detect, read and write the same capture files that
are supported by <strong>Wireshark</strong>.
The input file doesn't need a specific filename extension; the file
format and an optional gzip compression will be detected automatically.
Near the beginning of the DESCRIPTION section of <code>wireshark(1)</code> or
<a href="https://www.wireshark.org/docs/man-pages/wireshark.html">https://www.wireshark.org/docs/man-pages/wireshark.html</a>
is a detailed description of the way <strong>Wireshark</strong> handles this, which is
the same way <strong>reordercap</strong> handles this.</p>
<p>
</p>
<hr />
<h1><a name="options">OPTIONS</a></h1>
<dl>
<dt><strong><a name="n" class="item">-n</a></strong></dt>
<dd>
<p>When the <strong>-n</strong> option is used, <strong>reordercap</strong> will not write out the output
file if it finds that the input file is already in order.</p>
</dd>
<dt><strong><a name="v" class="item">-v</a></strong></dt>
<dd>
<p>Print the version and exit.</p>
</dd>
</dl>
<p>
</p>
<hr />
<h1><a name="see_also">SEE ALSO</a></h1>
<p><code>pcap(3)</code>, <code>wireshark(1)</code>, <code>tshark(1)</code>, <code>dumpcap(1)</code>, <code>editcap(1)</code>, <code>mergecap(1)</code>,
text2pcap(1), pcap-filter(7) or <code>tcpdump(8)</code></p>
<p>
</p>
<hr />
<h1><a name="notes">NOTES</a></h1>
<p><strong>Reordercap</strong> is part of the <strong>Wireshark</strong> distribution. The latest version
of <strong>Wireshark</strong> can be found at <a href="https://www.wireshark.org">https://www.wireshark.org</a>.</p>
<p>It may make sense to move this functionality into <strong>editcap</strong>, or perhaps
<strong>mergecap</strong>, in which case <strong>reordercap</strong> could be retired.</p>
<p>HTML versions of the Wireshark project man pages are available at:
<a href="https://www.wireshark.org/docs/man-pages">https://www.wireshark.org/docs/man-pages</a>.</p>
<p>
</p>
<hr />
<h1><a name="authors">AUTHORS</a></h1>
<pre>
Original Author
-------- ------
Martin Mathieson <martin.r.mathieson[AT]googlemail.com></pre>
</body>
</html>