Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How to set packet metadata in realtime?

Hello, I'd like to know if there is a mechanism/interface in tshark to modify packets while they are being live captured and before they are written into a .pcapng file.

What I'd like to accomplish is to set some metadata(I think the opt_comment field would be suitable for that) in the next incomming packet(s) after an external trigger.

If it's not possible with tshark, do you have any ideas how it could be done with another tool?

Thanks in advance!