|
if i open any pcap in wireshark, it will have several columns to display the information like src/dest ip & port no's, prot, info etc for each packet. i want one more column to be added which displays the data length field. i searched for this field but rather i could only find "packet length" field which shows the length of packet including the headers but i want only the payload length. is there any way to do that ?? OR is there any way to plot the graph with packet no on the x axis and payload length on the y axis ? |
|
You can add a new column like this:
Choose the Field Type to be Click Apply and Save. BTW: You can change the position of the column with drag-n-drop. Regards @kurt : thanks a lot. one more thing...is there any way to export only the payload bytes (rather than export in c arrays form which has headers also) or to plot the payload bytes vs packet number ?
(04 Jul '12, 02:55)
viks
1
you can do that with tshark. payload bytes
payload length
tcp.len is the payload length for TCP. For a list of other fields, run this command:
(04 Jul '12, 10:58)
Kurt Knochner
@kurt : thanks for the info. when i Choose the Field Type to be Custom and the Field name data.len it doesn't work. Any idea ?
(04 Jul '12, 19:02)
viks
the fields
(04 Jul '12, 22:40)
Kurt Knochner
|
