TraceRoo
Back to TraceRoo tools

packet capture tools

PCAP Merger

PCAP Merger helps when a call is captured from multiple points, such as customer LAN, SBC edge, and provider side. It reads the captures in the browser, sorts packets by timestamp, creates one merged classic PCAP, and shows the combined SIP call flow when clear SIP signaling is present.

What It Does

  • Reads multiple PCAP or PCAPNG files locally in the browser.
  • Combines packets and sorts them by packet timestamp.
  • Exports one merged classic PCAP for download.
  • Runs the merged capture through the SIP Call Flow Analyzer view.
  • Shows per-file packet and SIP message counts so you can spot missing call legs.

When To Use It

Use it when the call evidence is split across multiple capture points and you need one timeline for SIP review, customer handoff, or escalation.

Important Limits

  • Selected captures must use the same link-layer type, such as Ethernet with Ethernet.
  • Different machines may have clock skew, so merged ordering depends on capture timestamps.
  • The merger does not redact sensitive data. Use PCAP Redactor before sharing externally.
  • Encrypted SIP or missing SIP packets may still produce a merged PCAP without a ladder view.

Best Next Checks

  • Review the combined SIP ladder for the first failed response or missing ACK.
  • Use PCAP Splitter if the merged capture contains many Call-IDs.
  • Run RTP Health Analyzer when signaling succeeds but audio quality is the symptom.
  • Redact the merged PCAP before sending it to a customer or vendor.

How To Use PCAP Merger

  1. Choose two or more PCAP or PCAPNG files from the same investigation.
  2. Run Merge and visualize.
  3. Download the merged PCAP for storage or escalation.
  4. Review the combined SIP call flow below the download link.
  5. Use PCAP Splitter or PCAP Redactor next if the merged file is noisy or customer-facing.

Example Result

Split call legs LAN-side PCAP plus SBC-side PCAP
One merged classic PCAP Combined SIP call-flow view Per-file packet and SIP message counts
  • Use matching link-layer captures.
  • Check system clock skew before trusting gap timing.
  • Redact before customer handoff if needed.

FAQ

Does PCAP Merger upload the capture?

No. The merge and SIP visualization happen in the browser. The generated merged PCAP is created locally.

Why would I merge PCAPs?

Call legs are often captured from different network points. Merging them gives you one timestamped view so the SIP path and missing responses are easier to see.

Can it fix clock skew between capture machines?

No. It sorts by the timestamps already in the captures. If capture hosts have different clocks, review the ladder timing with that limitation in mind.