Sometimes you need to merge several capture files into one. For example, this can be useful if you have captured simultaneously from multiple interfaces at once (e.g., using multiple instances of Wireshark).
There are three ways to merge capture files using Wireshark:
- Use the → menu to open the “Merge” dialog. See Section 5.4.1, “The “Merge With Capture File” Dialog Box” for details. This menu item will be disabled unless you have loaded a capture file.
- Use drag and drop to drop multiple files on the main window. Wireshark will try to merge the packets in chronological order from the dropped files into a newly created temporary file. If you drop a single file, it will simply replace the existing capture.
-
Use the
mergecaptool from the command line to merge capture files. This tool provides the most options to merge capture files. See Section D.8, “mergecap: Merging multiple capture files into one” for details.
This lets you select a file to be merged into the currently loaded file. If your current data has not been saved you will be asked to save it first.
Most controls of this dialog will work the same way as described in the “Open Capture File” dialog box. See Section 5.2.1, “The “Open Capture File” Dialog Box” for details.
Specific controls of this merge dialog are:
- Prepend packets
- Prepend the packets from the selected file before the currently loaded packets.
- Merge chronologically
- Merge both the packets from the selected and currently loaded file in chronological order.
- Append packets
- Append the packets from the selected file after the currently loaded packets.
This is the common Windows file open dialog with additional Wireshark extensions.
This is the Qt file open dialog with additional Wireshark extensions.