Ask Your Question
0

Is it possible to put two different packages together within one line/tree on the main display?

asked 2021-07-26 10:16:11 +0000

SANTOS gravatar image

Hello,

I wrote a dissector in C language that works well. Now, I would like to use a post-dissector to regroup the lines that are displayed in the main Wireshark display, because there are multiple forwardings of the same packet.

I don't want to assemble a packet that was disassembled during transmission, I want to show several "equal" packets on the same line of the main display (I would like to build a tree on this line so you can see how many of the same packets were received) in order to reduce the visual pollution caused by dissecting the packets that are forwarded.

I read that post-dissectors are mainly used to record conversations, but they do not manipulate the lines of conversation they work on.

Is it possible to implement this idea of regrouping lines in the main display after passing through the dissector?

Thanks in advance,

Anderson

edit retag flag offensive close merge delete

Comments

You question isn't very clear to me, are you referring to the packet list or packet details panes?

grahamb gravatar imagegrahamb ( 2021-07-26 10:31:56 +0000 )edit

I am referring to the main display, where each line that is displayed represents a received packet, where we can read the information from each column (number, time, information, etc). I would like to join one or more lines, into a single line so that this line opens a tree and shows the lines contained in it.

SANTOS gravatar imageSANTOS ( 2021-07-26 11:21:12 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-07-26 11:32:05 +0000

grahamb gravatar image

Unfortunately no, the current Wireshark implementation is limited to displaying a single packet (from the underlying capture file) per packet list display line.

The data in the columns can be modified by dissectors as a result of multiple packets, the classic case is tcp reassembly, but the packets that make up the fragments are still displayed.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-07-26 10:16:11 +0000

Seen: 500 times

Last updated: Jul 26 '21