Re: [Ethereal-users] Capture from STDIN or a pipe

["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

From: <eelsten@xxxxxxx>

> 2. Merge the traffic
>       -Problem: There are no common frames.  This is all one flow of
> traffic being split by direction, therefore every frame is unique.

Why would there need to be "common" frames?
Mergecap will sort the packets according to the timestamp of each packet and
thus no
"common" frames are needed for mergecap to function.

As long as you have reasonably good timestamps and you capture both streams
on the
same maching (so the captures share share a common clock) mergecap should
be able to do what you want just fine.
Sure, not as nice as if ethereal could tap multiple NICs simultaneously but
better
than nothing.