Removing duplicate packets from pcap

Question

I want to analyze packet capture file, but it has some duplicate packets.

• For e.g., I am setting packet count to 10000 and seeing 11085 count in wireshark. So the goal is to remove duplicate packets which are 1085 in count. I am using latest wireshark version 1.10.2.

I would like to know if there is any way (command line option) using which I can discard duplicate packets and make new pcap with all unique packets.

Answer 1

You can use editcap which is part of the Wireshark package with the -d flag. More info here: http://www.wireshark.org/docs/man-pages/editcap.html#d