This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

how to add data length column in wireshark display or plot payload length vs packet no

0

if i open any pcap in wireshark, it will have several columns to display the information like src/dest ip & port no's, prot, info etc for each packet. i want one more column to be added which displays the data length field. i searched for this field but rather i could only find "packet length" field which shows the length of packet including the headers but i want only the payload length. is there any way to do that ??

OR

is there any way to plot the graph with packet no on the x axis and payload length on the y axis ?

asked 03 Jul '12, 23:32

viks's gravatar image

viks
16447
accept rate: 0%

edited 03 Jul '12, 23:38


One Answer:

1

You can add a new column like this:

Edit -> Preferences -> User Interface -> Columns -> Add

Choose the Field Type to be Custom and the Field name either tcp.len or udp.length.

Click Apply and Save. BTW: You can change the position of the column with drag-n-drop.

Regards
Kurt

answered 04 Jul '12, 01:55

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

@kurt : thanks a lot. one more thing...is there any way to export only the payload bytes (rather than export in c arrays form which has headers also) or to plot the payload bytes vs packet number ?

(04 Jul '12, 02:55) viks
1

you can do that with tshark.

payload bytes

tshark -r input.cap -T fields -e frame.number -e tcp.data -E header=y -E separator=;

payload length

tshark -r input.cap -T fields -e frame.number -e frame.len -e ip.len -e tcp.len -E header=y -E separator=;

tcp.len is the payload length for TCP. For a list of other fields, run this command:

tshark -G

(04 Jul '12, 10:58) Kurt Knochner ♦

@kurt : thanks for the info. when i Choose the Field Type to be Custom and the Field name data.len it doesn't work. Any idea ?

(04 Jul '12, 19:02) viks

the fields data.* will be only set if the dissector for a protcol is disabled (Analyze -> Enabled Protocols) or if there is no dissector for a protocol. Example: If you disable the protocol 'HTTP' and then data.len will work. You better use tcp.len or udp.length

(04 Jul '12, 22:40) Kurt Knochner ♦