Merging packet captures
If you have packet capture files that captured the same data, but from different viewpoints, you can merge them to create a more comprehensive packet capture.
Note: Only *.BFR format captures can be merged in Observer.
To merge packet captures, complete the following steps:
1. Click the File tab, and click Open > Local Packet Captures > Merge.
2. Type a file name for the resulting capture.
3. Click Add, and navigate to and open a saved *.BFR capture.
Repeat this step as necessary to add more captures. Also, when adding a capture you can also create a time adjustment for the other buffers (relative to the first buffer added).
4. Select your criteria for how duplicate packets are handled.
Skip duplicate packets only when packet time difference is less than
During evaluation, packets are only compared against packets that arrived at nearly the same time, or specifically during a time difference less than N-milliseconds. Setting this can help avoid some false-positive results, but you may need to experiment with the value.
Data link layer
If selected, layer 2 of the OSI Model is ignored when determining duplicate packets. For example, MAC addresses would not be examined when determining if a packet is a duplicate. They are ignored, but the rest of the packet is not.
IP time to live (TTL)
If selected, the time to live (TTL) value in packets would not be examined when determining if a packet is a duplicate. This is useful to select when the same packets makes multiple hops through routers.
IPv4 type of service or IPv6 traffic class
If selected, type of service (ToS) and traffic class (for IPv6) would not be examined when determining if a packet is a duplicate. The option is most useful when network hardware or software is changing these quality of service fields.
TCP sequence and acknowledgement numbers, and TCP options
If selected, TCP sequence and acknowledgement numbers, and also TCP options, are not would not be examined when determining if a packet is a duplicate. Overall, this ignores the ordering of the packets and the values of optional packet fields.
5. Click Start Merge.
Depending on the size of the captures, this process may take a few minutes.
 
You successfully merged packet captures. If you have additional capture files to merge with your new capture, do so by simply repeating the process indefinitely.