This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can I filter out frames without renumbering the frames?

0

When I used TShark to filter a capture file, the new output file starts with a new frame numbering, different from the frame number of the original file. Is there a way to indicate/instruct tshark to retain the frame number of the original file and not create a new frame number?

asked 25 Aug '13, 16:53

Hunted's gravatar image

Hunted
11334
accept rate: 0%

converted to question 25 Aug '13, 16:59

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196


One Answer:

1

Frame numbers are simply the ordinal numbers of frames within a file; they are not, in any of the file formats we support, stored as a property of the frame. Therefore, the only way to retain the frame numbers would be to write the file in a capture file format that supports per-frame comments, and make the original frame number a comment for the frame; you can't retain the frame numbers.

answered 25 Aug '13, 17:01

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

This has been discussed earlier and there is an entry in the pcapng wishlist. See the following question and the link therein

http://ask.wireshark.org/questions/13934/preserve-the-original-packet-number-after-applying-a-filter-on-a-pcap-file

(26 Aug '13, 06:02) Kurt Knochner ♦