Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How to save "Decode As" into .pcapng file?

I am using the latest Wireshark from master repository on Ubuntu 23.04. I test several different servers and install options with different port number configurations. I see I constantly set Analyze | Decode As to set protocol to be recognized on specific port.

I also know I can permanently save this info in Edit | Preferences | Protocols | specific protocol | TCP port(s).

But in my case port numbers frequently change and I don't want to set them permanently in Wireshark preferences, but also setting them manually in "Decode As" is also little bit annoying.

I am wondering if this decode as port relationship can be somehow saved in .pcapng file itself. This would be the best option for me. I am reopening captured files frequently and if port-decode-relationship would be there I think it would be the best.

Is it possible to save decode as info in .pcapng file?

Thanks