08-27-2018, 02:23 PM
Hi dizcza.
hcapcaptool -o option will convert pcapng files to hccapx format (not to pcapng) and append the result to an existing hccapx file.
The command you're looking for (merging pcapng files) is:
mergecap -a -w concatenated.pcapng capture1.pcapng capture2.pcapng
Read more here:
https://www.wireshark.org/docs/man-pages/mergecap.html
But I don't recommand merging of pcapng files. It can leed to uncrackable handshakes if ESSIDs are damaged or network names changed or MACs changed . Also detection of ap-less attacks will not work on merged files.
Keep in mind: we use randomized MACs. So clear allocation of MAC and ESSID over more than one pcapng file isn't possible on merged files.
hcapcaptool -o option will convert pcapng files to hccapx format (not to pcapng) and append the result to an existing hccapx file.
The command you're looking for (merging pcapng files) is:
mergecap -a -w concatenated.pcapng capture1.pcapng capture2.pcapng
Read more here:
https://www.wireshark.org/docs/man-pages/mergecap.html
But I don't recommand merging of pcapng files. It can leed to uncrackable handshakes if ESSIDs are damaged or network names changed or MACs changed . Also detection of ap-less attacks will not work on merged files.
Keep in mind: we use randomized MACs. So clear allocation of MAC and ESSID over more than one pcapng file isn't possible on merged files.