 | 1 | initial version |
Hello, I'd like to know if there is a mechanism/interface in tshark to modify packets while they are being live captured and before they are written into a .pcapng file.
No, there isn't.
What I'd like to accomplish is to set some metadata(I think the opt_comment field would be suitable for that) in the next incomming packet(s) after an external trigger.
If it's not possible with tshark, do you have any ideas how it could be done with another tool?
The only tool I know of that could do that would be a C compiler. :-)
I.e., I know of no packet-capturing tool that will do that for you, so you'd either have to write your own or modify an existing one.
