I recently had a need to open a 30gb pcap file.
The usual intermitant call issues so i had to start a new trace everyday so the file didnt get to large
Well sods law, the issue happens over the weekend so the pcap file had reached 30gb
trying to open that size file in wiresahrk caused it to crash
Even if it did open wireshark, it would be incredably slow
As we knew the time and date when the issue occured we wanted to filter the capture to that period
But as i could not open the file, i could not filter it
some googling later i found EDITCAP
command line utilitly built in to wireshark that allows you to do many things including extrating a time period from a pcpa file
here is my post on it
http://phonesystemhelp.info/how-to-edit-large-wireshark-files-with-editcap/hope someone finds it useful when fault finding sip issues
P.S i know i can use the "port 5060" command to only capture signalling but i needed the voice packets in this instance
P