Is there any way to obtain every 2nd, 3th, 7th etc. packet?
Is there any way to filter packets to get output that like "frame.number mod 7 == 0"?
Is there any way to filter packets to get output that like "frame.number mod 7 == 0"?
Added in dfilter: Handle arithmetic expressions on the LHS
Available now to test in the Automated Builds
You can also do arithmetic – you can add, subtract, multiply, and divide. You can use the modulo (%) operator, which gives you the remainder of integer division. Suppose your company has all of its web servers running on a port that ends in 443: 443, 1443, 5443, 21443, etc. You can use the modulo operator to match them like so:
{tcp.port % 1000} == 443
Not pretty but gets the job done.
Adds a new field frame_modulo.remainder
. Display filter: frame_modulo.remainder == "0"
-- frame_modulo.lua -- add field for modulo remainder -- https://ask.wireshark.org/question/25833/is-there-any-way-to-obtain-every-2nd-3th-7th-etc-packet/ local frame_modulo_info = { version = "1.0.0", author = "Chuck Craft", description = "Add modulo remainder field. Add menu to request divisor.", } set_plugin_info(frame_modulo_info) -- we create a "protocol" for our tree local frame_modulo_p = Proto("frame_modulo","Frame number modulo remainder") -- we create our fields local frame_modulo_field = ProtoField.string("frame_modulo.remainder", "Frame number modulo remainder") -- we add our fields to the protocol frame_modulo_p.fields = { frame_modulo_field } local modulo_divisor = 1 -- let's do it! function frame_modulo_p.dissector(tvb,pinfo,root) local tree = nil -- add our proto if we haven't already if not tree then tree = root:add(frame_modulo_p) end tree:add(frame_modulo_field, pinfo.number % modulo_divisor) end -- then we register frame_modulo_p as a postdissector register_postdissector(frame_modulo_p) -- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ -- Add new item to Tools menu local function dialog_menu() local function dialog_func(local_divisor) local window = TextWindow.new("Modulo divisor"); local message = string.format("Divisor set to %d. Reload capture file to apply.", local_divisor); window:set(message); modulo_divisor = local_divisor end new_dialog("Enter modulo divisor",dialog_func,"Divisor") end -- Create the menu entry register_menu("Modulo packets",dialog_menu,MENU_TOOLS_UNSORTED)
Odd (frame.number & 0x01)
and even !(frame.number & 0x01)
are pretty easy.
Thanks for answer! What about multiple of 3, 4, 5, 6, 7 etc?
Unfortunately, the filter language doesn't support arbitrary arithmetic, so that's not possible.
You could add this with a Lua plugin (WSDG: Lua Support in Wireshark) or open an Enhancement Request to extend the filtering syntax.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2022-01-24 02:06:45 +0000
Seen: 576 times
Last updated: Apr 01 '22
filtering open ports on wireshark
ERSPAN ID - Adding Information to captured packets
How can I search within data, specifically in the TCP segment data?
How to find the make and model of a local router? [closed]
Filter URL By Number Characters
How to find out total number of ip4 packets (that are not TCP,UDP or ICMP)
tshark filtering with SCTP segmentation not working?
Filter to all sockets/conversations matching at least one packet of the active display filter