Edit 100MB+ file

Question

I have captured some traffic with Wireshark and saved the result as a file. The file has 3 sections now:

1. request headers
2. response headers
3. response body

The response body is to become an flv file, but now everything is saved as a single file. So I need a way to delete the first two sections from the file, but the problem is that the file is very big (over a thousand mega bytes). I have tried to open it with gedit, but no matter how long I wait, gedit hangs and remains unresponsive until I kill it.

What tool can I use to edit this big file easily?

Answer 1

I doubt if Wireshark output that I am assuming to be a pcap file can be "nicely" divided into sections like request, response and body. The file would be a sequence of packets containing everything captured from the link layer onwards each prepended by a Wireshark header. Decoding the session that contributed to the transfer of say a big video file will require analyzing headers from the network protocol stack like IP, TCP and HTTP and combining the application level payload (e.g., HTTP).