Try using the "editcap" program that comes with Ethereal (or Wireshark). You will have much better success there. Martin Visser Technology Consultant Consulting & Integration Technology Solutions Group - HP Services 410 Concord Road Rhodes NSW 2138 Australia Mobile: +61-411-254-513 Fax: +61-2-9022-1800 E-mail: martin.visserAThp.com This email (including any attachments) is intended only for the use of the individual or entity named above and may contain information that is confidential, proprietary or privileged. If you are not the intended recipient, please notify HP immediately by return email and then delete the email, destroy any printed copy and do not disclose or use the information in it. -----Original Message----- From: ethereal-users-bounces@xxxxxxxxxxxx [mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Shier, Jon Sent: Wednesday, 2 August 2006 4:30 AM To: ethereal-users@xxxxxxxxxxxx Subject: [Ethereal-users] 6 gig ethereal file ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxxx Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-users ------------------- For some reason one of our tech's was capture at a site for a month and did not break the files up. I can't get ethereal to open the file as the thing is just to big. All I need is the last day of the capture, I have tried tethereal, but it does not seem to be filtering out what I want. Here is what I tried. tethereal -r c:\etherXXXXSXB8AT -w c:\outfile -R frame.time >= "July 27, 2006" So since the last day of the capture was the 27th I though this would work. When I look at the outfile size it's the same size as the original. Any thoughts? This is on a winxp. Jon Shier _______________________________________________ Ethereal-users mailing list Ethereal-users@xxxxxxxxxxxx http://www.ethereal.com/mailman/listinfo/ethereal-users
Powered by MHonArc 2.6.10