There are several command-line tools that can be utilized during the analysis of network packet captures. During more in-depth or lengthy incident response engagements, analysts may gather several packet captures files. It may be beneficial to combine these multiple packet captures into one single file to make analysis easier. The application mergecap does just that by combining several packet capture files. Mergecap is made as part of the CAINE OS and can be executed utilizing the following command:
caine@caine:~$ mergecap -w mergedpacketcapture.pcap packetcapture1.pcap packetcapture2.pcap
Another command-line tool that is useful in analyzing packet captures is the tool editcap. Editcap allows analysts to manipulate ...
