When you use NMCap to capture data you have an option to save the capture files as a chain. As the current capture file format has a limited size, this option allows you to continually capture the data in successive files. This also gives you some flexibility to limit the size. If you are sending files to another person for analysis you could send only the files that relate to the time period where a problem occurred. After using this feature; however, it might be useful to filter and re-stitch these capture files back together.
Capturing Chained Files with NMCap
You can capture using chained files using NMCap by naming the file with a .chn extension. The resulting files are named .cap, but they’ll be a "capfile(#).cap" for every chained capture file after the first one. So for instance using the following command:
NMCap /network * /capture ipv4.address==220.127.116.11 /file foo.chn:1M
Will produce capture files which are 1 meg in size and have the following names in this order: foo.cap, foo(1).cap, foo(2).cap and so on. I’ve also provided a capture filter to limit the traffic to just one address. However, for the best performance I would leave any filtering out.
Combining Captures with NMCap
Using NMCap, you can recombine these to create one large capture file. To do this use the /InputCapture option as follows:
NMCap /InputCapture foo.cap foo(1).cap foo(2).cap /Capture /File out.cap
You could additionally add a filter to limit the information that gets transferred. For instance, say I only wanted to see port 80 traffic in the resulting trace. In that case the following NMCap will get the job done.
NMCap /InputCapture foo.cap foo(1).cap foo(2).cap /Capture tcp.port==80 /File out.cap
Using a Script to Combine Many Capture Files
Now, this might get somewhat tedious the more files you have. We can solve this problem by using a simple CMD Script to create collect all the files for us. Just create a file using notepad called stitch.CMD and place in it these contents:
[Note: Fixed script and removed extraneous text]
The CMD script file takes three parameters; the first is the original file name without the .cap extension. The second is the output capture file. Add the 3rd is the filter which is optional. You’ll also want to run the script in the directory where all your captures are. Since it searches for *.cap, make sure there aren’t any extraneous captures.