Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How is the Wireshark Session Feature Implemented?

The Wireshark session feature, which involves statistics and conversations, allows selecting a specific conversation as a filter. Does this simply reparse the conversation's IP address and port as filter criteria for Wireshark to display, or does it parse packet data when opening a pcap file, add the parsed information to the saved session, and directly display each packet's information within the selected conversation when the session feature is invoked?