cacheline

3 ms·

1. 1.▲
   by cacheline 2y ago

   yep. For Wireshark/Tshark, display filters (including "frame.comment contains ...") can be used as usual. Of course, if your pcap file contains only frames with the same comment, that expression is not particularly useful, bu
2. 2.▲
   by cacheline 2y ago

   the pcap-ng file will contain packets (l2/l3/l4 and so forth, but up to 255 bytes), each annotated with a comment that tells you from what kernel function or tracepoint the packet was "captured" from. For the time being
3. 3.▲
   by cacheline 2y ago

   It would definitely be useful. This is part of the plan and we started exploring different possibilities (early stage, at the moment). Thank you for the feedback and for filing the feature request on GH.
4. 4.▲
   Tracing packets in the Linux kernel networking stack and friends(github.com)

   109 points by cacheline 2y ago|9 comments