Possible to add extra personalized labels to pcap file?

asked 2020-05-26 08:08:03 +0000

Artemis
5 ●2 ●2 ●3

Hi i would like to know if it's possible to add extra personalized labels to pcap file, once they are captured and stored. I think this can be done once transforming the pcap file to other fomats such as json and csv, while is there anyway i can add directly extra arbitrary information/fields to pcap files? Thanks a lot.

answered 2020-05-26 08:52:47 +0000

Anders

5023 ●97 ●58

Go to Statistics->file properties, at the bottom you can add and save file comments. It shold be possible to do with tshark as well check out the manual.

edit flag offensive delete link

Comments

Note you can also store a comment for each packet; right click a packet in the list and choose "Packet Comment..."

grahamb ( 2020-05-26 09:54:09 +0000 )edit

If you save the file, it'll have to be written out as a pcapng file, not a pcap file; pcap files don't support comments, but pcapng files do. ("pcap" isn't a generic term for packet captures, it's a specific term for a particular file format. "Capture file" is the proper generic term.)

Guy Harris ( 2020-05-26 10:53:11 +0000 )edit

Thanks a lot :)

Artemis ( 2020-05-27 08:26:40 +0000 )edit

To compliment the use of tshark to add a capture comment, editcap can be used to add individual frame comments.

Chuckc ( 2020-05-27 14:41:15 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Possible to add extra personalized labels to pcap file?

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Possible to add extra personalized labels to pcap file? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

Possible to add extra personalized labels to pcap file?