 | 1 | initial version |
No, you cannot save a 'decode as' instruction in a pcapng.
But you can add a comment to a pcapng.
And provide the 'decoce as' as a command line option -d. For example:
wireshark -d tcp.port==8888,http -r myfile.pcapng &
So it is possible to create a little script that launces Wireshark with the (temporary) decode as setting. (E.g. based on some info in the filename or extract the comment with tshark.)