Packet Slicing Example<br />With the increase in bandwidth and the introduction of capture devices, trace files used for analysis have grown. It is common to download or capture 500 MB, or 5 GB trace files. The issue starts when you try to open the trace file in Wireshark.<br />Before I get into this, I have mentioned in past articles to “know your tools” and determine at what file size Wireshark becomes ‘unusable’ on your system.<br />In this video I cover how I use editcap to packet slice and reduce the size for the trace file. When I have demonstrated packet slicing in the past I had some pretty good questions sent to me by my readers. <br />One question was “Does packet slicing result in a faster trace file load time?”. Unfortunately it really depends on a bunch of variables, but generally speaking, yes.<br />The other question I address in this video is “How long does it take to packet slice a 500 MB trace file?” It depends on your computer system specifications, but pretty fast. Like seconds, not minutes.<br />Watch the video and get some ideas on how packet slicing can help your packet analysis.<br />...<br /><a href="https://www.youtube.com/watch?v=tGY6Tdpy50Q" target="_blank" rel="nofollow">https://www.youtube.com/watch?v=tGY6Tdpy50Q</a>