Ask Your Question
0

How to create a custom colum for either TCP or UDP port?

asked 2018-05-18 13:00:40 +0000

keli gravatar image

updated 2018-05-18 13:06:20 +0000

I can add of course a custom column for either tcp.srcport or udp.srcport (and their dstport equivalents) but

is there a way to display the src/dst port information in the same custom column regardless of the Layer3 protocol used ? Since one packet will never be both TCP and UDP at the same time.

I randomly tried a few variations that I thought might make sense, but no lock. Is there any syntax (besides specific field data) to custom column? The custom editor says "Fields" in plural, but I cannot seem to be able to add more than one.

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
1

answered 2018-05-18 13:18:27 +0000

Pascal Quantin gravatar image

Hi,

In Fields simply put tcp.srcport || udp.srcport for the source port, or tcp.dstport || udp.dstport for the destination port.

edit flag offensive delete link more

Comments

Well, thank you both, sorry I cannot choose both as a valid answer :) I've tried each and of course got it to work with either answer.

I've marked Pascal's one as the accepted answer since it explains the format of the custom field, thus it's useful in other scenarios as well. I wasn't aware of the built-in column type apparently (although I recalled having this ages ago).

keli gravatar imagekeli ( 2018-05-18 14:52:57 +0000 )edit
1

answered 2018-05-18 14:40:20 +0000

cmaynard gravatar image

You don't need a custom column for this. Why not just use the Wireshark built-in columns? You can even choose resolved or unresolved ports.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-05-18 13:00:40 +0000

Seen: 49 times

Last updated: May 18