3 ms·
Can Wireshark parse comments in pcapng files, even with a dissector? /? ' https://www.google.com/search?q=Can+Wireshark+parse+comments+in+pcap+files https://ww
by westurner 2y ago
Can Wireshark parse comments in pcapng files, even with a dissector?
/? ' https://www.google.com/search?q=Can+Wireshark+parse+comments+in+pcap+files https://www.google.com/search?q=Can+Wireshark+parse+comments... :
frame.comment contains "Your string"
And there's apparently a way to add a custom column to display frame.comment from pcapng traces in wireshark
- cacheline 2y agoyep. For Wireshark/Tshark, display filters (including "frame.comment contains ...") can be used as usual. Of course, if your pcap file contains only frames with the same comment, that expression is not particularly useful, but you can merge multiple files with e.g. mergecap. The pcap subcommand, though, will be extended to allow extracting packets from multiple probes in a single run.