Have a look at the setting maximum number of cached rows (affects sorting) in the preferences under Appearance -> Layout. The default is quite low and if there are more displayed rows then the value of this setting, the packet list won't sort. You might want to increase it to a number higher to be able to sort larger lists of packets, but I think this will also affect the memory usage and speed of Wireshark (AFAIK).
There are a number of command line utilities that can be used to work on capture files, including splitting them.
Have a look at the utilities at the URL below. editcap may assist, but others may serve you better depending on exactly what you want to do. I'd suggest using these tools to split or filter your capture to reduce the number of packets you are lookin at when analysing in Wireshark. https://www.wireshark.org/docs/man-pages/
Asked: 2024-08-13 02:35:12 +0000
Seen: 112 times
Last updated: Aug 13
What do you mean by "package", do you mean capture file? If so, what size is it? There are tools in the Wireshark suite such as editcap that can split a large capture file into smaller chunks.
Or do you mean "packet"? The word used in English is generally "packet", even though, in some other languages, the word used might translate into English as "package".