1.1.2 Input syntax

Basic usage

You may provide the name of a PCAP trace file as input.

          wipal-cat input.pcap output.pcap

Input concatenation

You may provide the name of several PCAP traces separated with columns (do not include any space). This tells the program to consider the concatenation of each trace as a single input.

          wipal-cat input1.pcap:input2.pcap:input3.pcap output.pcap

will put into output.pcap the content of input1.pcap, followed by the content of input2.pcap and then input3.pcap.

Every program understands this syntax. Note that specifying multiple traces with columns makes no sense for outputs:

          wipal-cat input1.pcap:input2.pcap output1.pcap:output2.pcap

will concatenate input1.pcap and input2.pcap into a single file named output1.pcap:output2.pcap!

Address specification

Some programs (e.g. wipal-merge with attributes hsh_en2) might need the IPv4 address of the machine that generated a trace to work properly. Attach such an address to a trace as follows:

          wipal-merge -a hsh_en2 foo.pcap=192.168.1.1 bar1.pcap:bar2.pcap=192.168.1.2

The rationale is that, in some cases, timestamps of emitted frames are not as precise as timestamps of received frames, and thus emitted frames should be ignored during synchronization.

Special characters

When your traces' filenames contain the special characters : or = they need to be escaped with a backslash (\):

          wipal-cat weird\=file\:name.pcap out.pcap
          wipal-merge -a hsh_en2 weird\=1:weird\:2=192.168.1.1 foo.pcap=192.168.1.2