Ask Your Question
0

How to go to next colored packet

asked 2023-07-13 05:28:55 +0000

zhaoxian gravatar image

I want to navigate to the next colored packet within the displayed packets in Wireshark. For example, I have colored the packets based on the time interval between them, and I want to only show packets that satisfy the original filtering conditions and have a time interval of more than 1 second. However, these colored packets cannot be filtered using a new filter because it would change the filtering results and not show the desired content. But now, I am unable to navigate based on the coloring. How can I achieve this?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2023-07-13 08:14:19 +0000

SYN-bit gravatar image

Indeed filtering on time-differences is difficult as it changes the time-differences. For udp and tcp conversations, there are delta times available within a stream, which do not change by filtering. Have a look at the fields tcp.time_delta and udp.time_delta.

If that does not help, the answer to your original question to go to the next colored packet is to use the find function and then use the display filter option (which is the default) and then look for frame.coloring_rule.name == "TCP RST" (change the "TCP RST" to the name of your relevant color filter).

edit flag offensive delete link more

Comments

Thanks, it works well.

zhaoxian gravatar imagezhaoxian ( 2023-07-13 10:49:59 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2023-07-13 05:28:55 +0000

Seen: 131 times

Last updated: Jul 13 '23