Use Wireshark I/O Graph to display decoded JSON field value

edit

Hi Chuck, thanks, I think inside the proverbial wire (where pcap does the intercepting) it's a string. but shouldn't that be understood as a number after going through the Wireshark's JSON parser?

tshark seems interesting but I was hoping that there is a plotting tool within wireshark that would do the job. for me; in this particular case it isn't really a problem because I can easily plot with a simple python script with a JSON parser and matplotlib.

I was just wondering because these kind of tools exist (with i.e. CAN tools) and are quite handy sometimes.

Cheers

You could open an enhancement request.

Based on these comments in packet-json.c, the field type was questioned:

static header_field_info hfi_json_value_number JSON_HFI_INIT = /* FT_DOUBLE/ FT_INT64? */
    { "Number value", "json.value.number", FT_STRING, BASE_NONE, NULL, 0x00, "JSON number value", HFILL };

(not tested) You might try adding a Lua dissector to create a new numeric field and feed that to IO graph.

Hi Chuck, Thanks for the answer. I fixed my problem by making a custom plotter but I think This will be a cool feature for wireshark. Will be a super handy tool.