 | 1 | initial version |
It is possible to add multiple comments to a frame with editcap, but each additional comment must be added as new editcap command.
% tshark -V -r my.pcapng
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
...
% editcap -a "1:My 1st comment for frame 1" my.pcapng my.pcapng-1
% editcap -a "1:My 2nd comment for frame 1" my.pcapng-1 my.pcapng-2
% tshark -V -r my.pcapng-2
Packet comments
My 1st comment for frame 1
[Expert Info (Comment/Comment): My 1st comment for frame 1]
[My 1st comment for frame 1]
[Severity level: Comment]
[Group: Comment]
My 2nd comment for frame 1
[Expert Info (Comment/Comment): My 2nd comment for frame 1]
[My 2nd comment for frame 1]
[Severity level: Comment]
[Group: Comment]
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
...