My live traces get fairly large and get to where filtering takes a long time. Is there a way to discard unwanted packets from a live trace so that I don't have to restart the trace, but I can keep the live trace lean? E.g., once my trace gets to 500,000 packets, I may want to discard everything below frame.number==450000.
A ring buffer that rolls the files after a certain size is close to what you're looking for.
Dumpcap is doing the work underneath. Check -b|--ring-buffer to see how the options being set in the Wireshark Gui are used.
Is it ok to restart the GUI? What about using a read filter on the Wireshark command line?
-R|--read-filter <read (display) filter>
When reading a capture file specified with the -r flag, causes the specified filter (which uses the syntax of display filters, rather than that of capture filters) to be applied to all packets read from the capture file; packets not matching the filter are discarded.
If you want to keep the original packet number, maybe ignore packets below the frame.number cutoff.
Asked: 2020-10-13 15:45:56 +0000
Seen: 672 times
Last updated: Oct 13 '20
