This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

if i open any pcap in wireshark, it will have several columns to display the information like src/dest ip & port no's, prot, info etc for each packet. i want one more column to be added which displays the data length field. i searched for this field but rather i could only find "packet length" field which shows the length of packet including the headers but i want only the payload length. is there any way to do that ??

OR

is there any way to plot the graph with packet no on the x axis and payload length on the y axis ?

asked 03 Jul '12, 23:32

viks's gravatar image

viks
16447
accept rate: 0%

edited 03 Jul '12, 23:38


You can add a new column like this:

Edit -> Preferences -> User Interface -> Columns -> Add

Choose the Field Type to be Custom and the Field name either tcp.len or udp.length.

Click Apply and Save. BTW: You can change the position of the column with drag-n-drop.

Regards
Kurt

permanent link

answered 04 Jul '12, 01:55

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

@kurt : thanks a lot. one more thing...is there any way to export only the payload bytes (rather than export in c arrays form which has headers also) or to plot the payload bytes vs packet number ?

(04 Jul '12, 02:55) viks
1

you can do that with tshark.

payload bytes

tshark -r input.cap -T fields -e frame.number -e tcp.data -E header=y -E separator=;

payload length

tshark -r input.cap -T fields -e frame.number -e frame.len -e ip.len -e tcp.len -E header=y -E separator=;

tcp.len is the payload length for TCP. For a list of other fields, run this command:

tshark -G

(04 Jul '12, 10:58) Kurt Knochner ♦

@kurt : thanks for the info. when i Choose the Field Type to be Custom and the Field name data.len it doesn't work. Any idea ?

(04 Jul '12, 19:02) viks

the fields data.* will be only set if the dissector for a protcol is disabled (Analyze -> Enabled Protocols) or if there is no dissector for a protocol. Example: If you disable the protocol 'HTTP' and then data.len will work. You better use tcp.len or udp.length

(04 Jul '12, 22:40) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×832
×238
×72

question asked: 03 Jul '12, 23:32

question was seen: 21,421 times

last updated: 04 Jul '12, 22:40

p​o​w​e​r​e​d by O​S​Q​A