2 packet comments to a frame

editcap

asked 2022-07-10 10:19:41 +0000

mic11111
1 ●1 ●1 ●2

updated 2022-07-10 14:52:31 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

I need to add 2 different comments to a specific frame. I'm using editcap command . The problem is that when I try to do this:

editcap -a "1:comment1" -a "1:comment2"

only the second comment appears.

Is there a way to add 2 comments to one frame?

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2022-07-10 16:06:12 +0000

Jim Young
196 ●18 ●4

It is possible to add multiple comments to a frame with editcap, but each additional comment must be added as new editcap command.

% tshark -V -r my.pcapng 
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
 ...

% editcap -a "1:My 1st comment for frame 1" my.pcapng my.pcapng-1
% editcap -a "1:My 2nd comment for frame 1" my.pcapng-1 my.pcapng-2

% tshark -V -r my.pcapng-2         
Packet comments
    My 1st comment for frame 1
        [Expert Info (Comment/Comment): My 1st comment for frame 1]
            [My 1st comment for frame 1]
            [Severity level: Comment]
            [Group: Comment]
    My 2nd comment for frame 1
        [Expert Info (Comment/Comment): My 2nd comment for frame 1]
            [My 2nd comment for frame 1]
            [Severity level: Comment]
            [Group: Comment]
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
...

edit flag offensive delete link

Comments

You could skip the intermediate file by using pipes and - as filename:

editcap -a "1:comment 1" dummy.pcap - | \
editcap -a "1:comment 2" - dummy-with-2-comments.pcapng

SYN-bit ( 2022-07-10 18:39:16 +0000 )edit

Thanks for your answers. I have tried those solutions but I didn't succeed to see 2 comments . I could see only the last comment

mic11111 ( 2022-07-10 19:07:36 +0000 )edit

What version of tshark are you running? The ability to have multiple comments was added later? I typically run on recent development builds because I often want/need the newer features, in this case I was using TShark (Wireshark) 3.7.2rc0-87-gfad4d7f608e9.

Jim Young ( 2022-07-10 19:22:23 +0000 )edit

I see that I'm using Version 3.2.3 (Git v3.2.3 packaged as 3.2.3-1)

mic11111 ( 2022-07-10 19:29:00 +0000 )edit

add a comment