Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

How to make tshark/wireshark to analyze tcp flow group by interface_id

Hi guys. I have a pcapng file with multiple interfaces. It seems wireshark/tshark don't consider the interface while decoding the flows, for example, there are two exactly identical packets but with different interface id, and wireshark will show the second packet as "retransmission/duplicate/out of order".

So is there any way to tell wireshark to decode different interfaces separately?