Remove packet comments
Hi, I'm using "editcap -a" to add packet comment to a frame. Is there a way to clear any existing comments before new comment is added?
Not at present, so if you would like that than please file an enhancement request at https://gitlab.com/wireshark/wireshar... so that someone who's willing and got time can look into it. Or you may code it yourself if you like.
I can imagine something like these long options:
--add-packet-comment <frame:comment>
--discard-packet-comment [<frame[:index]>]
with frame and index as optional, so it can remove all packet comments in a frame or in the complete file.
Asked: 2022-09-04 19:37:25 +0000
Seen: 877 times
Last updated: Sep 05 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
I removed my answer due to a testing error. (missed a step rotating the output file back in as the input - oops)
The Usage and man page do need a little work to indicate what is possible with
-a.