Results 1 to 3 of 3

Thread: Trim or Edit a CAP file

  1. #1
    Just burned his ISO
    Join Date
    Nov 2008

    Default Trim or Edit a CAP file

    I've created a cap file using airodump that has a WPA handshake for my network, but the problem is I was lazy and captured every other local wireless point to me. While this is not a big deal for airocrack (BSSID selection) it is a big deal for some other WPA cracking software out there. I need to trim my CAP file to include only my wireless BSSID's handshake.

    Anything out there that will do this? I've googled and such but "trim" probably isn't the best descriptor and "extract" is too generic a term.

  2. #2
    Member imported_pynstrom's Avatar
    Join Date
    May 2008


    There may be an easier way to do it, but you could strip out the four frames using wireshark and then put them back together with mergecap.
    When hungry, eat your rice; when tired, close your eyes. Fools may laugh at me, but wise men will know what I mean. -- Lin-Chi
    - - - - - - - -
    I slept once, it was a Tuesday.

  3. #3
    Junior Member
    Join Date
    Sep 2008


    Set up a display filter in Wireshark so that only the frames you are interested are being displayed. Then you can do a File->SaveAs and choose to only save the displayed frames in a new file.

    -- Tom

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts