Here is a script that can use tshark to split a large pcap to multiple small pcaps
max=$(tshark -r $inpcap -n -T fields -e frame.number|tail -1)
# This is the number of packets in each split pcap
# Save all new pcaps to out, if it does not exist, create it.
[[ ! -d out ]] && mkdir out
for i in $(seq 1 $max $c)
tshark -r $inpcap -n -c $c "frame.number==$i" -w out/$i.pcap
#Do other stuff, if required
read -p "Send the next packet? "
A very simple 3-4 line script that has saved my day so may times.
Edit: I found a nice tcpdump cheatsheet https://comparite.ch/tcpdumpcs
First you need to have scapy installed. And if you don’t know about scapy, then
Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, tethereal, p0f, etc.). It also performs very well at a lot of other specific tasks that most other tools can’t handle, like sending invalid frames, injecting your own 802.11 frames, combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, …), etc
So, just install scapy
dnf install PyX scapy
Once done, start scapy so that you can capture and see the packet in pdf.