Is there a possibility to insert an empty line in the "packet list pane" of Wireshark on some particular spot? It should be as in the picture below - lines 8 and 10 look like "inserted". Wenn an empty line is marked, the packet details pane and the packet bytes pane shouls be empty too. I think about two possibilities:
Is something like this possible?
asked 15 May '12, 02:01  ZvDj edited 06 Nov '13, 04:38  Kurt Knochner ♦ |
4 Answers:
I don't think it is possible, because Wireshark is a tool to dissect and analyze what is there, and not an editor. Out of curiosity - why would you need a feature like that? I can't think of any reason why someone would want to add empty lines at all... answered 15 May '12, 02:21  Jasper ♦♦ |
You cannot insert an empty line, but you can ignore a certain packet, which looks almost like an empty line.
You can combine this with previously injected/inserted packets in the pcap file (e.g. ICMP packets with a certain length, to identify them). Unfortunately, I don't know any tool that is able to insert packets into a pcap file at a certain position. EDIT: I just remembered Network Expect. You can 'possibly' do it with Network Expect, however it requires quite some scripting know-how. Sample
If you just want a marker in your capture file please use that function (CTRL-M). Otherwise, please tell us more, as @Jasper already mentioned. Regards answered 15 May '12, 02:46 Kurt Knochner ♦ edited 15 May '12, 03:24 showing 5 of 6 show 1 more comments |
To answer your question regarding pcap diff If you "just" want a PCAP diff, there are tools available for that (e.g. pcapdiff). These tools will not show the differences in a graphical way, as they are mostly console tools. tpcat (Windows) PcapDiff (Perl) tracediff pcapdiff (python) Apparently, the later one is no longer accessible, however it's in several linux repositories (e.g. Fedora - Of course, you can also use the built-in compare option It is also possible to compare the text form of the captures. HOWEVER this will only work, if there are NO major changes in the cpature files, like NAT, packet reordering, etc !! Export the cpature files with tshark into text form and diff the output with WinMerge.
Diff both files with WinMerge:
Regards answered 15 May '12, 06:14 Kurt Knochner ♦ It would be nice, when "just PCAP diff" were :) There should be Compare options, compare filter, and of course, it should funct fast and also with very long files. (15 May '12, 08:53) ZvDj feel free to implement all that in wireshark :-) You will gain a lot of friends ;-) In the meantime you have all the options described above. (15 May '12, 09:11) Kurt Knochner ♦ |
Pretty sure scapy can do this, but the easiest one will be ColaSoft PacketBuilder Original capture After importing it to PacketBuilder and inserting 2 entries ( see new frames 4 and 7)
you can then edit the values of the fields you inserted out of curiosity, why would you want to do this? I use colasoft sometimes for a way to create asynchronous environments hope this helps thx answered 29 Feb '16, 06:29  ppcap |
I thought of that, too, but that would remove a packet from view which I don't think was intended - if you want to have an empty line without losing anything you can't ignore a packet :-)
that's true and I'm suggesting it only out of thin air, as there was not enough information in the original post ;-)
see latest EDIT above
Thanks for answers.
My intention is to open two instances of wireshark (thanks Kurt) and to compare two PCAP Files. If some Packet in a first file is absent, there should be shown an empty line (in the firstInstance), and at the second file (in the second instance) should be shown the whole packet.
The "packet list pane" is nothing but some kind of ListView Control, and there should be possible to insert un empty line. The question is only, if something like this in Wireshark possible is.
@Kurt: I will try NetExect soon. Thx
Best regards to all Zvonko
I mean NetExpect ;)
> The question is only, if something like this in Wireshark possible is.
Unfortunately no. See answers/comments above.
Regarding "pcap diff", see my answer below.