is it possible to have only one entry in packet table for specific vlan id even if we got 1000 packets of that vlan id , diiferent or same protocol & whatever be contents of that packet ?
Currently , we have to capture lot of packets then sort by vlan id & scroll through a long list to find what diferent vlan id's we received on our system.
asked 05 Nov '12, 00:41
edited 05 Nov '12, 12:49
Guy Harris ♦♦
You can't do that in the GUI, but that's were tshark can help. Capture your data with either Wiresahrk, dumpcap or tshark and write it to input.cap.
Then call tshark to extract the VLAN IDs.
This will print all vlan IDs. However, you will get duplicates. So you need to filter those duplicates with a script and/or other tools.
Sort the values in numerical ascending order and eliminate duplicates.
answered 05 Nov '12, 01:09
Kurt Knochner ♦
No. That's not what the packet table is for. The "packet table" is a table of, well, packets, so there's one entry in the packet table for each packet.
It would be possible to have a statistics tap that displayed a table showing all VLAN IDs in the capture, just as we already have taps to show, for example, all Ethernet or IPv4 or IPv6 or... addresses in the capture. Taps can be written in Lua, although I'm not sure whether a Lua tap can pop up a table display in the GUI in Wireshark rather than just print it out as text in TShark.
answered 05 Nov '12, 12:48
Guy Harris ♦♦