When I used TShark to filter a capture file, the new output file starts with a new frame numbering, different from the frame number of the original file. Is there a way to indicate/instruct tshark to retain the frame number of the original file and not create a new frame number? asked 25 Aug '13, 16:53  Hunted converted to question 25 Aug '13, 16:59  Guy Harris ♦♦ |
One Answer:
Frame numbers are simply the ordinal numbers of frames within a file; they are not, in any of the file formats we support, stored as a property of the frame. Therefore, the only way to retain the frame numbers would be to write the file in a capture file format that supports per-frame comments, and make the original frame number a comment for the frame; you can't retain the frame numbers. answered 25 Aug '13, 17:01 Guy Harris ♦♦ |
This has been discussed earlier and there is an entry in the pcapng wishlist. See the following question and the link therein