This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When I used TShark to filter a capture file, the new output file starts with a new frame numbering, different from the frame number of the original file. Is there a way to indicate/instruct tshark to retain the frame number of the original file and not create a new frame number?

asked 25 Aug '13, 16:53

Hunted's gravatar image

Hunted
11334
accept rate: 0%

converted to question 25 Aug '13, 16:59

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


Frame numbers are simply the ordinal numbers of frames within a file; they are not, in any of the file formats we support, stored as a property of the frame. Therefore, the only way to retain the frame numbers would be to write the file in a capture file format that supports per-frame comments, and make the original frame number a comment for the frame; you can't retain the frame numbers.

permanent link

answered 25 Aug '13, 17:01

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

This has been discussed earlier and there is an entry in the pcapng wishlist. See the following question and the link therein

http://ask.wireshark.org/questions/13934/preserve-the-original-packet-number-after-applying-a-filter-on-a-pcap-file

(26 Aug '13, 06:02) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×349
×2

question asked: 25 Aug '13, 16:53

question was seen: 2,361 times

last updated: 26 Aug '13, 06:02

p​o​w​e​r​e​d by O​S​Q​A