Padding pcap files

When recording network traffic (e.g. with tcpdump) only n bytes (the snaplen) are recorded. If the snaplen is shorter than the packet size, you will have truncated packets in you dump file.

If you do have such a pcap file and you need the packets to have the size that is specified in the IP header, then you can use tcprewrite to pad the data. tcprewrite is part of the tcpreplay program suite:

tcprewrite –infile in.pcap –outfile out.pcap -F pad