wireshark对重复包进行过滤

工作中收到别人抓的包，但是发现数据包重复了，因为涉及到分析，需要将重复的去掉，在网上搜索了一番，也没有相关的内容。

于是在wireshark的帮助里面，搜索"delete"，发现有如下工具：

Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]<infile> and <outfile> must both be present.A single packet or a range of packets can be selected.Packet selection:  -r                     keep the selected packets; default is to delete them.  -A <start time>        only output packets whose timestamp is after (or equal                         to) the given time (format as YYYY-MM-DD hh:mm:ss).  -B <stop time>         only output packets whose timestamp is before the                         given time (format as YYYY-MM-DD hh:mm:ss).Duplicate packet removal:  -d                     remove packet if duplicate (window == 5).  -D <dup window>        remove packet if duplicate; configurable <dup window>                         Valid <dup window> values are 0 to 1000000.                         NOTE: A <dup window> of 0 with -v (verbose option) is                         useful to print MD5 hashes.  -w <dup time window>   remove packet if duplicate packet is found EQUAL TO OR                         LESS THAN <dup time window> prior to current packet.                         A <dup time window> is specified in relative seconds                         (e.g. 0.000001).           NOTE: The use of the 'Duplicate packet removal' options with           other editcap options except -v may not always work as expected.           Specifically the -r, -t or -S options will very likely NOT have the           desired effect if combined with the -d, -D or -w.Packet manipulation:  -s <snaplen>           truncate each packet to max. <snaplen> bytes of data.  -C <choplen>           chop each packet by <choplen> bytes. Positive values                         chop at the packet beginning, negative values at the                         packet end.  -t <time adjustment>   adjust the timestamp of each packet;                         <time adjustment> is in relative seconds (e.g. -0.5).  -S <strict adjustment> adjust timestamp of packets if necessary to insure                         strict chronological increasing order. The <strict                         adjustment> is specified in relative seconds with                         values of 0 or 0.000001 being the most reasonable.                         A negative adjustment value will modify timestamps so                         that each packet's delta time is the absolute value                         of the adjustment specified. A value of -0 will set                         all packets to the timestamp of the first packet.  -E <error probability> set the probability (between 0.0 and 1.0 incl.)                         that a particular packet byte will be randomly changed.Output File(s):  -c <packets per file>  split the packet output to different files                         based on uniform packet counts                         with a maximum of <packets per file> each.  -i <seconds per file>  split the packet output to different files                         based on uniform time intervals                         with a maximum of <seconds per file> each.  -F <capture type>      set the output file type; default is libpcap.                         an empty "-F" option will list the file types.  -T <encap type>        set the output file encapsulation type;                         default is the same as the input file.                         an empty "-T" option will list the encapsulation types.Miscellaneous:  -h                     display this help and exit.  -v                     verbose output.                         If -v is used with any of the 'Duplicate Packet                         Removal' options (-d, -D or -w) then Packet lengths                         and MD5 hashes are printed to standard-out.

可以使用-d来去掉重复的包。

在wireshark的安装目录下，找到有editcap.exe。

因此，使用cmd命令，指定源文件和目标文件，得到了新的文件：

D:\Program Files\Wireshark>editcap -d d:\test.pcap d:\testresult.pcap
66848 packets seen, 27991 packets skipped with duplicate window of 5 packets.