mergecap

mergecap -w out.pcap a.pcap b.pcap

Combines multiple pcaps into one time-ordered file with mergecap, joining the partial captures of the incident.

Run it when you have multiple captures from the same segment or the same time period and need to analyze them as one: mergecap joins the pcaps and sorts packets by timestamp — the result is the complete view of the traffic without the gaps from partial captures. In IR, pcaps from different sensors or different time windows are merged for global analysis: the C2 connection that starts in one capture and continues in another is seen in full. It's also used to combine captures from both directions of a span.

Don't use it with captures from different time periods without thinking: the merge mixes windows that may not be comparable (traffic from different days). Time ordering assumes synchronized clocks: captures from sensors with skewed clocks produce a misleading merge — verify timestamps with capinfos first. And watch out for size: merging large captures doubles the space and the subsequent analysis (tshark, Zeek) takes proportionally longer. To work with a specific window, editcap (105) trims before merging.