 | 1 | initial version |
No, you cannot save a 'decode as' instruction in a pcapng.
But you can add a comment to a pcapng.
And provide the 'decoce as' as a command line option -d. For example:
wireshark -d tcp.port==8888,http -r myfile.pcapng &
So it is possible to create a little script that launces Wireshark with the (temporary) decode as setting. (E.g. based on some info in the filename or extract the comment with tshark.)
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.