mixup TCP sessions in pcap file to new pcap file

I need to shuffle TCP sessions from pcap file to new file. How can I do it? The following scripts don't work for me. -------------------- To mix up sessions in a pcap file using Tshark or Wireshark, you can use the following steps: 1. Rename the original pcap file to something else (optional): This step is not necessary but can help keep track of the original pcap file. You can use the following command to rename the file:

-shell
    mv original.pcap original_original.pcap

2. Extract individual sessions from the original pcap file using Tshark: Use Tshark to extract individual sessions from the original pcap file into separate pcap files, like this:

-shell
    tshark -r original_original.pcap -Y "tcp.stream == X" -w session_X.pcap

Replace X with the desired session number. Repeat this command for each session you want to extract, incrementing X accordingly. 3. Mix up the extracted pcap files: Use a bash script to randomly concatenate the extracted pcap files into a new mixed-up pcap file. Here is an example script (mixup_pcap.sh) that uses the shuf command to shuffle the filenames randomly and then appends them to a new file:

-bash
    #!/bin/bash
    output_pcap="mixed_sessions.pcap"
    session_files=(session_*.pcap)
 
    # Randomly shuffle the session files
    shuffled_files=($(shuf -e "${session_files[@]}"))

    # Concatenate the shuffled pcap files into a new mixed-up pcap file
    for file in "${shuffled_files[@]}"; do
        cat "$file" >> "$output_pcap"
    done

    echo "Mixed-up pcap file created: $output_pcap"

Save the above script to mixup_pcap.sh, make it executable using chmod +x mixup_pcap.sh, and then run it using ./mixup_pcap.sh. 4. Analyze the mixed-up pcap file: You can open the generated mixed-up pcap file (mixed_sessions.pcap) in Wireshark or use Tshark to analyze it further. Note: Make sure you have Tshark installed on your system to execute the above steps. To mix up sessions in a pcap file using Tshark or Wireshark, you can use the following steps: 1. Rename the original pcap file to something else (optional): This step is not necessary but can help keep track of the original pcap file. You can use the following command to rename the file:

-shell
    mv original.pcap original_original.pcap

2. Extract individual sessions from the original pcap file using Tshark: Use Tshark to extract individual sessions from the original pcap file into separate pcap files, like this:

-shell
    tshark -r original_original.pcap -Y "tcp.stream == X" -w session_X.pcap

Replace X with the desired session number. Repeat this command for each session you want to extract, incrementing X accordingly. 3. Mix up the extracted pcap files: Use a bash script to randomly concatenate the extracted pcap files into a new mixed-up pcap file. Here is an example script (mixup_pcap.sh) that uses the shuf command to shuffle the filenames randomly and then appends them to a new file:

-bash
    #!/bin/bash
    output_pcap="mixed_sessions.pcap"
    session_files=(session_*.pcap)
    
    # Randomly shuffle the session files
    shuffled_files=($(shuf -e "${session_files[@]}"))
    
    # Concatenate the shuffled pcap files into a new mixed-up pcap file
    for file in "${shuffled_files[@]}"; do
        cat "$file" >> "$output_pcap"
    done
    
    echo "Mixed-up pcap file created: $output_pcap"

Save the above script to mixup_pcap.sh, make it executable using chmod +x mixup_pcap.sh, and then run it using ./mixup_pcap.sh. 4. Analyze the mixed-up pcap file: You can open the generated mixed-up pcap file (mixed_sessions.pcap) in Wireshark or use Tshark to analyze it further. Note: Make sure you have Tshark installed on your system to execute the above steps.