This is a development snapshot of pcapsplit. At this moment pcapsplit is only
capable of splitting pcap files into several smaller pieces. 

Use 

$ autoreconf -i
$ ./configure
$ make

in order to compile pcapsplit. You need the development version of libpcap
installed on you system.

The configuration is done via ini files. These files configure all the modules
that pcapsplit uses to split the source file. Each of these modules does have
its on section in within the files. The following modules are currently
implemented:

- sizedumper -- Splits a single pcap files into several smaller files. The
  configuration for this module is given like this:

	[size_dumper]
	file_prefix=/path/to/file/prefix
	size=size in bytes
  
  The resulting files will be no bigger than size "size". Some files might be
  smaller because the split is only performed on a packet boundary. Packets
  will not be splitted in the middle of the packet. 
  If a big pcap file is splitted into n smaller files, the resulting output
  files will be named $file_prefix.[0-n].

- filterdumper -- Splits a single pcap files into several files according to
  pcap filter rules. The configuration is performed as follows:

	[filter_dumper]
	file_prefix=/path/to/file/prefix
	numer_of_classes=2

	class1=ip
	filter1="ip"

	class2=ip6
	filter2="ip6"

  The configuration specifies an file prefix in the variable "file_prefix" and
  the number of output classes in "number_of_classes". The variables "class"
  and "filter" need to be existent for every class. For examle, if
  "number_of_classes" is two, there must be the configuration variables
  "class1", "filter1", "class2", "filter2". 
  The string given in "classN" defines the filename of the output pcap file.
  For example, the configuration

	file_prefix='/foo/bar/pcap-'
	class1 = 'ip'

  will result in a pcap filen named '/foo/bar/pcap-ip'. Note that the
  directory for the pcap file MUST exist because pcapsplit does not create any
  directories. The variable "filterN" defines the pcap filter for the class N. 
  The filter format must be in tcpdump(1) format.

- flowstart_dumper: Similar to filter_dumper but allows the configuration of a
  cutoff per connection. The module performs connection tracking (acctually
  bi-flow tracking). A cutoff can be defined by class and is specified in
  bytes. A cutoff of N bytes means only N bytes per bi-flow are stored to the
  classes pcap file. A definition of a class could be

	class1=ip
	filter1="ip and tcp and port 80"
	cutoff1=15000

  which would match all TCP traffic with source or destination port 80 over
  IPv4. The parameter "cutoff1" would result in 15000 bytes per connection to
  captured.
  It is also possible to specify the maximum pcap file size for a class by
  configuring the variable

	file_size1 = 100000000

  This results in maximum pcap files that have the size 100000000 the output
  Afterwards, a new file is produced for the class. The filenames are produced
  in a form like '$file_prefix$class_name-$i' where $i is a running number
  that starts with 0 at programm-start and is increased everytime a new
  class-file is started.
  The flow-dumper module aims at dumping the first N bytes of each connections
  and tries to reassemble the corresponding functionallity of the time-machine
  (TODO: links to time machine) and was inspired by the program.

Please email bug reports, feature requests, etc to

	Lothar Braun <lothar@lobraun.de>