mergecap命令批量合并pcap

acat@acat-xx:~$ mergecap --help
Mergecap (Wireshark) 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu18.04.0)
Merge two or more capture files into one.
See https://www.wireshark.org for more information.

Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]

Output:
  -a                concatenate rather than merge files.
                    default is to merge based on frame timestamps.
  -s <snaplen>      truncate packets to <snaplen> bytes of data.
  -w <outfile>|-    set the output filename to <outfile> or '-' for stdout.
  -F <capture type> set the output file type; default is pcapng.
                    an empty "-F" option will list the file types.
  -I <IDB merge mode> set the merge mode for Interface Description Blocks; default is 'all'.
                    an empty "-I" option will list the merge modes.

Miscellaneous:
  -h                display this help and exit.
  -v                verbose output.
 

-F参数指定输出文件的格式，默认输出pcapng格式的，也可以输出其他格式。

<pre><font color="#8AE234"><b>acat@acat-xx</b></font>:<font color="#729FCF"><b>~</b></font>$ mergecap -F
mergecap: option requires an argument -- &apos;F&apos;
mergecap: The available capture file types for the &quot;-F&quot; flag are:
    5views - InfoVista 5View capture
    btsnoop - Symbian OS btsnoop
    commview - TamoSoft CommView
    dct2000 - Catapult DCT2000 trace (.out format)
    erf - Endace ERF capture
    eyesdn - EyeSDN USB S0/E1 ISDN trace format
    k12text - K12 text file
    lanalyzer - Novell LANalyzer
    logcat - Android Logcat Binary format
    logcat-brief - Android Logcat Brief text format
    logcat-long - Android Logcat Long text format
    logcat-process - Android Logcat Process text format
    logcat-tag - Android Logcat Tag text format
    logcat-thread - Android Logcat Thread text format
    logcat-threadtime - Android Logcat Threadtime text format
    logcat-time - Android Logcat Time text format
    modpcap - Modified tcpdump - pcap
    netmon1 - Microsoft NetMon 1.x
    netmon2 - Microsoft NetMon 2.x
    nettl - HP-UX nettl trace
    ngsniffer - Sniffer (DOS)
    ngwsniffer_1_1 - NetXray, Sniffer (Windows) 1.1
    ngwsniffer_2_0 - Sniffer (Windows) 2.00x
    niobserver - Network Instruments Observer
    nokiapcap - Nokia tcpdump - pcap
    nsecpcap - Wireshark/tcpdump/... - nanosecond pcap
    nstrace10 - NetScaler Trace (Version 1.0)
    nstrace20 - NetScaler Trace (Version 2.0)
    nstrace30 - NetScaler Trace (Version 3.0)
    nstrace35 - NetScaler Trace (Version 3.5)
    pcap - Wireshark/tcpdump/... - pcap
    pcapng - Wireshark/... - pcapng
    rf5 - Tektronix K12xx 32-bit .rf5 format
    rh6_1pcap - RedHat 6.1 tcpdump - pcap
    snoop - Sun snoop
    suse6_3pcap - SuSE 6.3 tcpdump - pcap
    visual - Visual Networks traffic capture
<font color="#8AE234"><b>acat@acat-xx</b></font>:<font color="#729FCF"><b>~</b></font>$ 
</pre>

使用linux shell脚本，把多个文件夹中的多个pcap合并为每个文件夹对应一个pcap

# **********  a.sh  ************ 
#!/bin/bash
outputPcap="outputDir"
rm -rf $outputPcap
mkdir $outputPcap
echo "输出文件夹："$outputPcap
my_array=(`ls -l | grep ^d | tail -n+1 | awk -F ' ' '{print $NF}'`)
for i in ${my_array[@]}
do
 cd ${i}
 echo "文件夹：${i}"
 outPcapName=${i}_.pcap
 echo $outPcapName
    mergecap -w ../${outputPcap}/${outPcapName} `ls | grep .*.pcap` &#让该命令在后台执行
 # ls | grep .*.pcap
 cd ..
done