Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have captured some traffic with Wireshark and saved the result as a file. The file has 3 sections now:

  1. request headers
  2. response headers
  3. response body

The response body is to become an flv file, but now everything is saved as a single file. So I need a way to delete the first two sections from the file, but the problem is that the file is very big (over a thousand mega bytes). I have tried to open it with gedit, but no matter how long I wait, gedit hangs and remains unresponsive until I kill it.

What tool can I use to edit this big file easily?

share|improve this question
Did you try with command line text editors? nano or vim? – medigeek Jun 24 '12 at 14:06
@medigeek - I am very clumsy with command line tools, but I'd give it a shot. – Majid Fouladpour Jun 24 '12 at 14:10
This seems like a convoluted way to steal a flash video – tgm4883 Jun 24 '12 at 14:15
@tgm4883 - It may seem so, but it's not. – Majid Fouladpour Jun 24 '12 at 14:23
@MajidFouladpour As the file is really huge, I'd have written some sort of program in C/C++ to manipulate it.. Create a program to do what you would do with the file if you were able to open the file in some texteditor. i.e. operations like Search, delete, add text etc. – drake01 Jun 24 '12 at 14:24

I doubt if Wireshark output that I am assuming to be a pcap file can be "nicely" divided into sections like request, response and body. The file would be a sequence of packets containing everything captured from the link layer onwards each prepended by a Wireshark header. Decoding the session that contributed to the transfer of say a big video file will require analyzing headers from the network protocol stack like IP, TCP and HTTP and combining the application level payload (e.g., HTTP).

share|improve this answer
I'm giving this a +1. There should be a "Follow TCP stream" in wireshark.. or something to make things easier... – medigeek Jun 24 '12 at 19:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.