tcpdump - Filter first ten minutes of pcap -

i have large pcap file, , generate new pcap contains first ten minutes of traffic. can tcpdump? have seen editcap mentioned online, use tcpdump if possible.

you can tcpdump; however, simpler editcap because practical way tcpdump can think of use wireshark (or tshark) first find frame number of packet @ least 10 minutes capture file. once have frame number, tcpdump can used save packets until frame, limiting output file desired 10 minute duration. here's how:

first, find first packet @ least 10 minutes capture file (here i'll illustrate tshark, wireshark used well):

tshark -r bigfile.pcap -y "frame.time_relative <= 600.0" 

note frame number of last packet displayed. (the frame number first number of each row, assuming standard tshark columns.) illustrative purposes, let's it's frame number 21038.

second, use tcpdump save first 21038 frames new file:

tcpdump -r bigfile.pcap -c 21038 -w bigfile_first10min.pcap 

but since editcap comes wireshark suite, more accomplish equivalent using following, split large capture file capture files each of 10 minutes in duration (except last one, might less):

editcap -f pcap -i 600 bigfile.pcap bigfile_split10min.pcap 

if you're interested in first file, disregard rest of them.

of course noted @madmax1, apply simple modification above tshark command write packets matching filter new file:

tshark -r bigfile.pcap -y "frame.time_relative <= 600.0" -w bigfile_first10min.pcap