Is it possible to put two different packages together within one line/tree on the main display?
Hello,
I wrote a dissector in C language that works well. Now, I would like to use a post-dissector to regroup the lines that are displayed in the main Wireshark display, because there are multiple forwardings of the same packet.
I don't want to assemble a packet that was disassembled during transmission, I want to show several "equal" packets on the same line of the main display (I would like to build a tree on this line so you can see how many of the same packets were received) in order to reduce the visual pollution caused by dissecting the packets that are forwarded.
I read that post-dissectors are mainly used to record conversations, but they do not manipulate the lines of conversation they work on.
Is it possible to implement this idea of regrouping lines in the main display after passing through the dissector?
Thanks in advance,
Anderson
You question isn't very clear to me, are you referring to the packet list or packet details panes?
I am referring to the main display, where each line that is displayed represents a received packet, where we can read the information from each column (number, time, information, etc). I would like to join one or more lines, into a single line so that this line opens a tree and shows the lines contained in it.