reordercap

I am still making order out of chaos by reinvention. — John le Carre

Why reorder packets by timestamp

You are passing captures into utils like mergecap which require it
The lack of packet order is making it hard for you to analyze a pcap.

Caveats

Cannot use same input & output file

reordercap will not error with reordercap $file $file, but when you read the file, the packets will be in order but now malformed.

Cannot read from a pipe

bash-5.0$ mkfifo myfifo
bash-5.0$ tshark -r out-of-order.pcap -w myfifo & reordercap myfifo out-of-order.pcap
[1] 3941
reordercap: The file "myfifo" is a pipe or FIFO; reordercap can't read pipe or FIFO files in two-pass mode.

Examples

For these examples, using this cloudshark file

Reorder an out of order pcap

$ reordercap http-out-of-order.pcapng inorder.pcapng
10 frames, 1 out of order

Try to reorder it again with -n

$ reordercap -n inorder.pcapng inorder2.pcapng
10 frames, 0 out of order
Not writing output file because input file is already in order.

Reordering file of the same name with pipe

# Using a pipe
bash-5.0$ mkfifo myfifo
bash-5.0$ reordercap out-of-order.pcap myfifo & tshark -r myfifo -w out-of-order.pcap

# Using a temp file
bash-5.0$ reordercap out-of-order.pcap temp
bash-5.0$ mv temp out-of-order.pcap