editcap slice

editcap -A 2026-11-01 -B 2026-11-02 in.pcap out.pcap

Trim a pcap to a time window with editcap, isolating the incident window from irrelevant traffic.

Run it when the pcap covers more than you need: editcap with -A (from) and -B (until) extracts only the packets in the indicated window — subsequent analysis works on the relevant fragment, not on hours of traffic. In IR, the incident window (the alert period, the attacker's session) is isolated from the rest: tshark, Zeek, and searches run faster and results don't get polluted with traffic before and after. It's the scoping step before any serious analysis of a long capture.

Don't use it without knowing the incident window: trimming blindly can leave out relevant traffic (connections before the event are usually part of the story — the reconnaissance phase). Time-based trimming requires reliable timestamps: captures with skewed clocks produce shifted windows. And watch out: editcap generates a new file — the original pcap is preserved as evidence and the fragment is the working copy. For filter-based trimming (not time-based), tshark with a read filter is the alternative.