Digital Forensics and Incident Response - Second Edition

Command-line tools

There are several command-line tools that can be utilized during the analysis of network packet captures. During more in-depth or lengthy incident response engagements, analysts may gather several packet capture files. It may be beneficial to combine these multiple packet captures into one single file to make analysis easier. The application Mergecap does just that by combining several packet capture files. Mergecap is offered as part of the CAINE OS and can be executed utilizing the following command:

caine@caine:~$ mergecap -w mergedpacketcapture.pcap packetcapture1.pcap packetcapture2.pcap

Another command-line tool that is useful in analyzing packet captures is the tool Editcap. Editcap allows analysts to manipulate ...