Ask Your Question

Remove packet comments

asked 2022-09-04 19:37:25 +0000

mic11111 gravatar image

updated 2022-09-04 19:39:12 +0000

Hi, I'm using "editcap -a" to add packet comment to a frame. Is there a way to clear any existing comments before new comment is added?

edit retag flag offensive close merge delete


I removed my answer due to a testing error. (missed a step rotating the output file back in as the input - oops)
The Usage and man page do need a little work to indicate what is possible with -a.

Chuckc gravatar imageChuckc ( 2022-09-06 13:21:52 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2022-09-05 08:53:10 +0000

Jaap gravatar image

Not at present, so if you would like that than please file an enhancement request at so that someone who's willing and got time can look into it. Or you may code it yourself if you like.

I can imagine something like these long options:
--add-packet-comment <frame:comment>
--discard-packet-comment [<frame[:index]>]
with frame and index as optional, so it can remove all packet comments in a frame or in the complete file.

edit flag offensive delete link more

answered 2022-09-05 10:09:09 +0000

grahamb gravatar image

The option --discard-capture-comment was added some time ago, see this commit. Not sure what version it went out in though the docs imply it's present in 3.6.6.

There is also the associated --capture-comment that allows the addition of multiple comments.

edit flag offensive delete link more


Indeed, but these are capture file comment related options. The question was regarding comments on _frames_

Jaap gravatar imageJaap ( 2022-09-05 14:57:57 +0000 )edit

Oops, missed that particular bit of the question.

grahamb gravatar imagegrahamb ( 2022-09-05 15:03:00 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-09-04 19:37:25 +0000

Seen: 882 times

Last updated: Sep 05 '22