slice_pcap
Filter or slice PCAP files by packet number range, time window, or remove duplicates using editcap.
Instructions
Slice or filter a PCAP file using editcap.
Args: filepath: Path to input PCAP file output_file: Output file path (.pcap or .pcapng) start_packet: First packet number to keep (1-based) end_packet: Last packet number to keep start_time: Keep packets after this time (editcap -A format) end_time: Keep packets before this time (editcap -B format) remove_duplicates: Remove duplicate packets
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filepath | Yes | ||
| output_file | Yes | ||
| start_packet | No | ||
| end_packet | No | ||
| start_time | No | ||
| end_time | No | ||
| remove_duplicates | No |