title: How to modify the timestamp range of a .pcap file?
body: <h1>Problem</h1>
  
  <p>I need to modify a .pcap file captured over a timespan of 5 minutes such that it simulates a .pcap file captured over a timespan of 20 minutes. The problem is that I don't know how to do this.</p>
  
  <h2>Example</h2>
  
  <p>To illustrate the problem, suppose I have a .pcap file with 4 captured packets <code>p1</code>-<code>p4</code> and <code>t</code> as a start time such that:</p>
  
  <ul>
  <li><code>p1</code> is sent at <code>t</code>+ 0 minutes</li>
  <li><code>p2</code> is sent at <code>t</code>+ 1 minutes</li>
  <li><code>p3</code> is sent at <code>t</code>+ 2 minutes</li>
  <li><code>p4</code> is sent at <code>t</code>+ 3 minutes</li>
  </ul>
  
  <p>I want my resulting .pcap file to contain the same four packets but with the timestamps scaled (from 5 minutes to 20 minutes) such that they represent the following:</p>
  
  <ul>
  <li><code>p1</code> is sent at <code>t</code>+ 0 minutes</li>
  <li><code>p2</code> is sent at <code>t</code>+ 4 minutes</li>
  <li><code>p3</code> is sent at <code>t</code>+ 8 minutes</li>
  <li><code>p4</code> is sent at <code>t</code>+ 12 minutes</li>
  </ul>
  
  <h2>Tried solution(s)</h2>
  
  <ul>
  <li><code>editcap</code>, however the only option I could find here is to adjust all timestamps with a set value using the <code>-t</code> option.</li>
  </ul>
  
  <h2>Background</h2>
  
  <p>I am using <code>tcpreplay</code> to replay a scenario in which a user browsers a webpage. I simultaniously inject some packets <strong>which are dependent</strong> on the .pcap file I replayed, i.e. the packets are injected by live monitoring of the replayed traffic and subsequently adjusting the packets it sends out. This entire traffic trace - i.e. both the replayed traffic and the injected packets - are captured using <code>tcpdump</code>. As there are a lot of large .pcap files I want to replay, I use the <code>tcpreplay --multiplier</code> option to speed up the process. However, this means the final capture is a compressed version of the original .pcap file. I would like to 'stretch' the newly created .pcap to be the same size as the original.</p>