tcpdump exits before completing the merge

[AfakTolgi]

tcpdump exits before completing the merge

[infrastation]

Awesome! However, if the bug report was genuine, the reporter would have provided the actual steps to reproduce, so if it stays like this, it will be closed as invalid.

[infrastation]

Something is off in the problem description because for the specified invocation tcpdump would not write any output file, instead it would exit with the following error:

tcpdump: 1.pcap,2.pcap: No such file or directory

Please check which program you use and the exact steps to reproduce.

[guyharris]

In particular, tcpdump does not support reading multiple files and merging them into one file - and, even if it did, it wouldn't support it with the -r flag taking a comma-separated list of files, as a comma is a perfectly valid character in a file name.

Perhaps this is a version of tcpdump that somebody's modified to work that way? If so, then you will have to report this to the person or people who modified tcpdump.

[fenner]

This project does have a program that will combine multiple pcap files: tcpslice. The resulting file will contain all packets from all input files in order by timestamp (e.g., strictly speaking tcpslice has no way to have all the packets from 1.pcap followed by those from 2.pcap; it can only combine by time)

[fxlb]

With official tcpdump:
echo -e "file1.pcap\nfile2.pcap\nfile3.pcap\n" | tcpdump -V - -w output.pcap

[infrastation]

As discussed.