Ask Your Question
0

Possible to add extra personalized labels to pcap file?

asked 2020-05-26 08:08:03 +0000

Artemis gravatar image

Hi i would like to know if it's possible to add extra personalized labels to pcap file, once they are captured and stored. I think this can be done once transforming the pcap file to other fomats such as json and csv, while is there anyway i can add directly extra arbitrary information/fields to pcap files? Thanks a lot.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-05-26 08:52:47 +0000

Anders gravatar image

Go to Statistics->file properties, at the bottom you can add and save file comments. It shold be possible to do with tshark as well check out the manual.

edit flag offensive delete link more

Comments

Note you can also store a comment for each packet; right click a packet in the list and choose "Packet Comment..."

grahamb gravatar imagegrahamb ( 2020-05-26 09:54:09 +0000 )edit

If you save the file, it'll have to be written out as a pcapng file, not a pcap file; pcap files don't support comments, but pcapng files do. ("pcap" isn't a generic term for packet captures, it's a specific term for a particular file format. "Capture file" is the proper generic term.)

Guy Harris gravatar imageGuy Harris ( 2020-05-26 10:53:11 +0000 )edit

Thanks a lot :)

Artemis gravatar imageArtemis ( 2020-05-27 08:26:40 +0000 )edit

To compliment the use of tshark to add a capture comment, editcap can be used to add individual frame comments.

Chuckc gravatar imageChuckc ( 2020-05-27 14:41:15 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-05-26 08:08:03 +0000

Seen: 95 times

Last updated: May 26