I am still making order out of chaos by reinvention. — John le Carre
1 min |  Ross Jacobs |  March 3, 2019

Table of Contents

Quicklinks: manpage | Wireshark Docs | code

Reordercap is a simple utility that orders all packets by timestamp.


Cannot use same input & output file

reordercap will not error with reordercap $file $file, but when you read the file, the packets will be in order but now malformed.

Cannot read from a pipe

bash-5.0$ mkfifo myfifo
bash-5.0$ tshark -r out-of-order.pcap -w myfifo & reordercap myfifo out-of-order.pcap
[1] 3941
reordercap: The file "myfifo" is a pipe or FIFO; reordercap can't read pipe or FIFO files in two-pass mode.


For these examples, using this cloudshark file

  • Reorder an out of order pcap

      $ reordercap http-out-of-order.pcapng inorder.pcapng
      10 frames, 1 out of order
  • Try to reorder it again with -n

      $ reordercap -n inorder.pcapng inorder2.pcapng
      10 frames, 0 out of order
      Not writing output file because input file is already in order.
  • To reorder a file in place, use a temp file

    # Using a temp file
    bash-5.0$ reordercap out-of-order.pcap temp
    bash-5.0$ mv temp out-of-order.pcap