A command-line tool that merges multiple pcap files while gracefully handling corrupt or malformed input.
joincap is a command-line utility written in Go that merges multiple pcap (packet capture) files into a single output file. It solves the problem of failed merge operations due to corrupt or malformed input files by gracefully skipping problematic packets rather than aborting the entire process.
Network engineers, security analysts, and developers who work with packet capture data and need to combine multiple pcap files for analysis, especially when dealing with potentially corrupted captures from various sources.
Developers choose joincap over alternatives like mergecap or tcpslice because it handles corrupted input files gracefully without requiring external repair tools, simplifying workflows and ensuring merge jobs complete successfully.
Merge multiple pcap files together, gracefully.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Skips corrupt packets and files instead of failing, ensuring merge jobs complete successfully even with malformed inputs, as demonstrated in the detailed error handling table.
Handles gzipped pcaps (.pcap.gz), empty files, directories, and truncated data directly, without requiring pre-processing steps like decompression.
Eliminates the need for external tools like pcapfix by internal error handling, simplifying workflows and reducing resource usage.
Offers a clean command-line interface with options for output file, size limits, and timestamp precision, making it easy to integrate into scripts.
Benchmarks show merging speeds comparable to mergecap and tcpslice, with high throughput for large files, as noted in the performance comparison.
Designed to skip corrupt packets, which means some data may be omitted from the merged output, potentially unacceptable for forensic or debugging purposes where every packet counts.
Focuses solely on merging; lacks advanced capabilities like packet filtering, editing, or live capture support found in more comprehensive pcap tools such as Wireshark or tcpdump.
Currently at version 0.10.2, indicating it's not yet a stable 1.0 release, which might concern users for production environments due to potential breaking changes or bugs.
joincap is an open-source alternative to the following products:
Mergecap is a command-line network analysis tool from the Wireshark suite that merges multiple packet capture files into a single output file for analysis.
tcpslice is a tool for extracting portions of pcap files based on time, useful for analyzing specific periods of network traffic.