Remove packet comments
Hi, I'm using "editcap -a" to add packet comment to a frame. Is there a way to clear any existing comments before new comment is added?
Hi, I'm using "editcap -a" to add packet comment to a frame. Is there a way to clear any existing comments before new comment is added?
Not at present, so if you would like that than please file an enhancement request at https://gitlab.com/wireshark/wireshar... so that someone who's willing and got time can look into it. Or you may code it yourself if you like.
I can imagine something like these long options:
--add-packet-comment <frame:comment>
--discard-packet-comment [<frame[:index]>]
with frame and index as optional, so it can remove all packet comments in a frame or in the complete file.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2022-09-04 19:37:25 +0000
Seen: 971 times
Last updated: Sep 05 '22
how to use editcap to split the btmon captured file
Changing Interface Name via Editcap
editcap and per-file comments in pcapng files...
How can i remove packet headers with script
Change frame/tcp length on sliced packets
[Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP
editcap.exe returns "File mycapturefile.pcapng is a Wireshark/... - pcapng capture file"
I removed my answer due to a testing error. (missed a step rotating the output file back in as the input - oops)
The Usage and man page do need a little work to indicate what is possible with
-a
.