Is there any way to obtain every 2nd, 3th, 7th etc. packet?
Is there any way to filter packets to get output that like "frame.number mod 7 == 0"?
Added in dfilter: Handle arithmetic expressions on the LHS
Available now to test in the Automated Builds
You can also do arithmetic – you can add, subtract, multiply, and divide. You can use the modulo (%) operator, which gives you the remainder of integer division. Suppose your company has all of its web servers running on a port that ends in 443: 443, 1443, 5443, 21443, etc. You can use the modulo operator to match them like so:
{tcp.port % 1000} == 443
Not pretty but gets the job done.
Adds a new field frame_modulo.remainder. Display filter: frame_modulo.remainder == "0"
-- frame_modulo.lua
-- add field for modulo remainder
-- https://ask.wireshark.org/question/25833/is-there-any-way-to-obtain-every-2nd-3th-7th-etc-packet/
local frame_modulo_info =
{
version = "1.0.0",
author = "Chuck Craft",
description = "Add modulo remainder field. Add menu to request divisor.",
}
set_plugin_info(frame_modulo_info)
-- we create a "protocol" for our tree
local frame_modulo_p = Proto("frame_modulo","Frame number modulo remainder")
-- we create our fields
local frame_modulo_field = ProtoField.string("frame_modulo.remainder", "Frame number modulo remainder")
-- we add our fields to the protocol
frame_modulo_p.fields = { frame_modulo_field }
local modulo_divisor = 1
-- let's do it!
function frame_modulo_p.dissector(tvb,pinfo,root)
local tree = nil
-- add our proto if we haven't already
if not tree then
tree = root:add(frame_modulo_p)
end
tree:add(frame_modulo_field, pinfo.number % modulo_divisor)
end
-- then we register frame_modulo_p as a postdissector
register_postdissector(frame_modulo_p)
-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-- Add new item to Tools menu
local function dialog_menu()
local function dialog_func(local_divisor)
local window = TextWindow.new("Modulo divisor");
local message = string.format("Divisor set to %d. Reload capture file to apply.", local_divisor);
window:set(message);
modulo_divisor = local_divisor
end
new_dialog("Enter modulo divisor",dialog_func,"Divisor")
end
-- Create the menu entry
register_menu("Modulo packets",dialog_menu,MENU_TOOLS_UNSORTED)
Odd (frame.number & 0x01) and even !(frame.number & 0x01) are pretty easy.
Thanks for answer! What about multiple of 3, 4, 5, 6, 7 etc?
Unfortunately, the filter language doesn't support arbitrary arithmetic, so that's not possible.
You could add this with a Lua plugin (WSDG: Lua Support in Wireshark) or open an Enhancement Request to extend the filtering syntax.
Asked: 2022-01-24 02:06:45 +0000
Seen: 680 times
Last updated: Apr 01 '22