As much as I like ethereal it has a really annoying flaw; it only works on files less than 2 gigs big. I've been dumping some NTP traffic for 2 months and have 18G file to process, and tethereal complains
tethereal: The file "foo.pcap" could not be opened: Value too large for defined data type.
I'm not patient enough to wade through the ethereal code to fix it, so instead I wrote a quick and dirty Python script to split a pcap file into 1 gig pieces: splitpcap.py. Maybe someone will find this useful.
tech
  2005-11-26 18:01 Z