Ask Your Question

Is there any way to obtain every 2nd, 3th, 7th etc. packet?

asked 2022-01-24 02:06:45 +0000

Is there any way to filter packets to get output that like "frame.number mod 7 == 0"?

edit retag flag offensive close merge delete

3 Answers

Sort by ยป oldest newest most voted

answered 2022-04-01 15:06:30 +0000

Chuckc gravatar image
edit flag offensive delete link more

answered 2022-01-26 05:01:34 +0000

Chuckc gravatar image

Not pretty but gets the job done.
Adds a new field frame_modulo.remainder. Display filter: frame_modulo.remainder == "0"

-- frame_modulo.lua
-- add field for modulo remainder

local frame_modulo_info =
    version = "1.0.0",
    author = "Chuck Craft",
    description = "Add modulo remainder field. Add menu to request divisor.",


-- we create a "protocol" for our tree
local frame_modulo_p = Proto("frame_modulo","Frame number modulo remainder")

-- we create our fields
local frame_modulo_field = ProtoField.string("frame_modulo.remainder", "Frame number modulo remainder")

-- we add our fields to the protocol
frame_modulo_p.fields = { frame_modulo_field }

local modulo_divisor = 1

-- let's do it!
function frame_modulo_p.dissector(tvb,pinfo,root)
    local tree = nil

    -- add our proto if we haven't already
    if not tree then
        tree = root:add(frame_modulo_p)

    tree:add(frame_modulo_field, pinfo.number % modulo_divisor)

-- then we register frame_modulo_p as a postdissector

-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

-- Add new item to Tools menu
local function dialog_menu()
    local function dialog_func(local_divisor)
        local window ="Modulo divisor");
        local message = string.format("Divisor set to %d. Reload capture file to apply.", local_divisor);

        modulo_divisor = local_divisor


    new_dialog("Enter modulo divisor",dialog_func,"Divisor")

-- Create the menu entry
register_menu("Modulo packets",dialog_menu,MENU_TOOLS_UNSORTED)

edit flag offensive delete link more

answered 2022-01-24 03:07:56 +0000

Chuckc gravatar image

Odd (frame.number & 0x01) and even !(frame.number & 0x01) are pretty easy.

edit flag offensive delete link more


Thanks for answer! What about multiple of 3, 4, 5, 6, 7 etc?

HbcOfficial gravatar imageHbcOfficial ( 2022-01-24 18:14:53 +0000 )edit

Unfortunately, the filter language doesn't support arbitrary arithmetic, so that's not possible.

Guy Harris gravatar imageGuy Harris ( 2022-01-24 21:00:13 +0000 )edit

You could add this with a Lua plugin (WSDG: Lua Support in Wireshark) or open an Enhancement Request to extend the filtering syntax.

Chuckc gravatar imageChuckc ( 2022-01-26 02:31:12 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-01-24 02:06:45 +0000

Seen: 107 times

Last updated: Apr 01