Ask Your Question
0

2 packet comments to a frame

asked 2022-07-10 10:19:41 +0000

mic11111 gravatar image

updated 2022-07-10 14:52:31 +0000

grahamb gravatar image

I need to add 2 different comments to a specific frame. I'm using editcap command . The problem is that when I try to do this:

editcap -a "1:comment1" -a "1:comment2"

only the second comment appears.

Is there a way to add 2 comments to one frame?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
0

answered 2022-07-10 16:06:12 +0000

Jim Young gravatar image

It is possible to add multiple comments to a frame with editcap, but each additional comment must be added as new editcap command.

% tshark -V -r my.pcapng 
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
 ...

% editcap -a "1:My 1st comment for frame 1" my.pcapng my.pcapng-1
% editcap -a "1:My 2nd comment for frame 1" my.pcapng-1 my.pcapng-2

% tshark -V -r my.pcapng-2         
Packet comments
    My 1st comment for frame 1
        [Expert Info (Comment/Comment): My 1st comment for frame 1]
            [My 1st comment for frame 1]
            [Severity level: Comment]
            [Group: Comment]
    My 2nd comment for frame 1
        [Expert Info (Comment/Comment): My 2nd comment for frame 1]
            [My 2nd comment for frame 1]
            [Severity level: Comment]
            [Group: Comment]
Frame 1: 1399 bytes on wire (11192 bits), 1399 bytes captured (11192 bits) on interface eth0, id 0
...
edit flag offensive delete link more

Comments

You could skip the intermediate file by using pipes and - as filename:

editcap -a "1:comment 1" dummy.pcap - | \
editcap -a "1:comment 2" - dummy-with-2-comments.pcapng
SYN-bit gravatar imageSYN-bit ( 2022-07-10 18:39:16 +0000 )edit

Thanks for your answers. I have tried those solutions but I didn't succeed to see 2 comments . I could see only the last comment

mic11111 gravatar imagemic11111 ( 2022-07-10 19:07:36 +0000 )edit

What version of tshark are you running? The ability to have multiple comments was added later? I typically run on recent development builds because I often want/need the newer features, in this case I was using TShark (Wireshark) 3.7.2rc0-87-gfad4d7f608e9.

Jim Young gravatar imageJim Young ( 2022-07-10 19:22:23 +0000 )edit

I see that I'm using Version 3.2.3 (Git v3.2.3 packaged as 3.2.3-1)

mic11111 gravatar imagemic11111 ( 2022-07-10 19:29:00 +0000 )edit
0

answered 2022-07-10 15:04:52 +0000

grahamb gravatar image

Adding multiple frame comments using editcap doesn't seem to be currently supported.

Please raise an issue at the Wireshark GitLab issues list, options to consider are:

  • The syntax to indicate a frame comment should be added
  • The syntax to indicate all comments for a frame should be replaced
  • The syntax to indicate a specific frame comment should be replaced
  • Additional syntax to delete a specific or all comments for a frame
edit flag offensive delete link more

Comments

Chuckc gravatar imageChuckc ( 2022-07-11 15:41:21 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-07-10 10:19:41 +0000

Seen: 82 times

Last updated: Jul 10