System administration command. Reads and manipulates packet capture files created by tcpdump -w. Based on timestamps, extract portions of or merge together files. Display all packets between the given start and end times. tcpslice understands most time and date formats. tcpslice also understands a relative time format specified as a unit of time--e.g., +1h10m to specify the first hour and ten minutes of packets in the specified files. This format is named ymdhmsu after the letters it uses to denote units of time: years, months, days, hours, minutes, seconds, and microseconds. If no constraining dates are specified, the command will print out all packets contained in files.
Print the start and end time of the specified range, then exit.
When merging files, don’t discard duplicate packets.
Merge packets based on the time relative to the start of the file. The default is to merge based on the absolute timestamp.
Print the time and date of the first and last packet in each file, then exit.
Print the raw timestamp of the first and last packet in each file, then exit.
Print times associated with the first and last packet in each file in ymdhmsu format.
Write output to file instead of standard output.