Ask Your Question

How to export part of a TCP stream to a .pcapng file?

asked 2022-06-20 01:59:48 +0000

markleo gravatar image

updated 2022-06-20 04:47:12 +0000

grahamb gravatar image

How to export part of a TCP stream to a .pcapng file?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-06-20 16:16:11 +0000

Jim Aragon gravatar image

Apply a display filter to show just the packets you want to export. From your image, it looks like you want packets 1624 through 1628. Because the packet numbers are continuous, with no gaps, you could use this display filter:

frame.number > 1623 && frame.number < 1629

Then go to File > Export Specified Packets. Browse to where you want to save the file. Enter the file name in the "File name" field. Check that the pcapng file type is selected in the "Save as type" field. That's the default, so it should already be selected. Under "Packet Range," "All packets" should be selected and "Displayed" should be selected. Again, those are the defaults, so they should already be selected. Click "Save" to save the new file.

Note that the original packet numbers will not be preserved, so packets 1624 - 1628 from the original file will be packets 1 - 5 in your new file.

If the packets you wanted to save were not in a continuous range, you could mark the packets of interest (Mark functions are on the View menu), and then on the Export Specified Packets dialog, instead of "All packets" you could select "Marked packets only."

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-06-20 01:59:48 +0000

Seen: 59 times

Last updated: Jun 20