Add a pcap-split tool

README.md

@@ -11,6 +11,12 @@ make run            # or: go run . -addr localhost:8080
 
 Then open http://localhost:8080.
 
+Flags:
+- `-addr`: listen address (default `localhost:8080`).
+- `-max-upload-mb`: largest accepted file upload in MB (default 1024).
+
+Uploads larger than 1 MB are spooled to temporary files under `$TMPDIR` (default `/tmp`) rather than held in memory. The temporary files are removed after each request.
+
 ## Tools
 
 ### Hex → pcap (`/hex2pcap`)
@@ -36,12 +42,24 @@ Builds a single-packet pcap file from pasted hex.
 - **Link type**: *Auto* picks Raw IP when layer 2 is empty and layer 3 is set, and Ethernet otherwise. You can also pick a link type from the list or enter any numeric LINKTYPE.
 - **Preview** shows the fixups that were applied and a hex dump coloured by layer, with changed bytes underlined. **Download pcap** returns the file.
 
+### Split pcap (`/split`)
+
+Splits an uploaded pcap file into parts with at most N packets or at most N KB/MB/GB each. Sizes are decimal (1 MB = 1,000,000 bytes) and count the 24-byte file header and the 16-byte per-packet record headers.
+
+- The parts are returned as one zip of `<name>_001.pcap`, `<name>_002.pcap`, ...
+- Each part starts with the original file header, and packet records are copied byte for byte, so byte order and µs/ns timestamp precision are preserved.
+- A packet larger than the size limit goes into a part by itself.
+- If the capture ends with a truncated packet, that packet is dropped, and the zip comment says so.
+- A split may produce at most 10,000 parts.
+- The upload is checked completely before the zip is sent, so errors show on the page instead of as a broken download.
+- Only classic pcap is supported. Convert pcapng first with `editcap -F pcap in.pcapng out.pcap`.
+
 ## Layout
 
 ```
 main.go                 entry point, HTTP server
 internal/web/           handlers, tool registry, embedded templates and CSS
-internal/pcap/          pcap file writer
+internal/pcap/          pcap file reader, writer and splitter
 internal/inet/          IPv4/IPv6 length and checksum fixups, IP header locator
 internal/hexutil/       lenient hex decoding
 ```