wireshark_editcap_trim
Trim a packet capture file to a specified start and end time. Retain only packets within the time window to reduce file size and focus analysis.
Instructions
Trim a capture file to a timestamp window using editcap.
Args: input_file: Source capture file output_file: Destination capture file start_time: Optional inclusive start time in editcap format stop_time: Optional exclusive stop time in editcap format
Returns: Success message or JSON error
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| stop_time | No | ||
| input_file | Yes | ||
| start_time | No | ||
| output_file | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |