PacketSafari

Make a PCAP File Smaller

Reduce PCAP upload size by exporting selected packets, slicing payloads, or using PacketSafari adaptive truncation while preserving useful headers.

Shrinking a PCAP makes uploads faster and keeps investigations focused. You can trim captures before uploading or from inside PacketSafari using Save special packets (see Edit PCAP).

Option 1: Trim in Wireshark

  1. Open the capture, apply a display filter that keeps only the packets you need.
  2. Choose File → Export Specified Packets.
  3. Export only Displayed or Selected packets, and save a new file.

Option 2: Slice payloads

Use editcap -s 128 original.pcapng sliced.pcapng to keep headers and drop payload bytes. This is useful when upload limits apply or payloads are sensitive.

If you want to anonymize and shrink in one step, use the anoncap workflow. The standalone anoncap default uses boundary-only adaptive truncation, so it keeps supported nested headers and removes payload beyond the computed boundary without a fixed byte target.

Tune the payload controls only when you need a different behavior:

  • choose a fixed Slice bytes value when you need a minimum retained byte count
  • use full-payload keep mode when a private/deep rules profile must inspect L7 values
  • use zero-after-boundary when a downstream tool requires the original captured length

Adaptive truncation covers nested tunnels and quotes such as GRE, ERSPAN, Ethernet-in-GRE / TEB, IP-in-IP, MPLS-over-GRE, QinQ, PPPoE, GTP-U with extension headers, L2TP, Geneve, VXLAN, VXLAN-GPE, Teredo, NSH, and ICMP/ICMPv6 quoted packets. It preserves more useful inner headers before truncating, so the anonymized copy stays easier to analyze.

Option 3: Slice after upload

In the analyzer, mark packets of interest, then use Save special packets to write a smaller PCAP. You can also slice to a fixed length and download the sanitized copy.

After trimming, upload the new file to PacketSafari for processing and analysis.