sound alert?

No. Personally I would find this extremely annoying, but if you want this in Wireshark please create an item in the Wireshark Bugzilla and mark it as an enhancement.

but is it possible to configure it to make a sound when a packet goes through pre defined filter?

This implies (for me) that you want to use Wireshark as a real time monitoring tool for your network traffic (as it would only make sense to use the alert sound in that way). However Wireshark and/or tshark are both analyzing tools that are not meant to work in real-time for a long time, although you can use it like that for a short period of time.

Now, if you can't use Wireshark as a long term and real time monitoring tool, how much sense does it make to let Wireshark play a sound if you click on a certain frame or if you apply a certain display filter? You know that you did that, so why let Wireshark bark at you?

That would be rather annoying, except for blind people. However I'm not sure if you can use Wireshark with a braille display ;-))

I believe you need/want a way to use Wireshark/tshark as a long term, real time monitoring tool, that uses pre-defined filters to trigger a definable action, as soon as that filter matches (like: if there is an arp request, beep twice). Unfortunately, there is no (long term, real time) monitoring only version of Wireshark/tshark right now and based on the architecture of Wiresharks dissection engine, it's rather hard to implement that, but it's not impossible.

Regards
Kurt

This question is old, and my answer may not be quite what you were looking for, and perhaps not helpful to you at all if you're not running on the Windows platform, but ...

If you are using Windows and a new enough version of dumpcap (1.10.0 or later should suffice), then you should be able to have sound/music played when a capture event occurs through the hooks provided by the dumpcap.bat batch file I wrote and posted at http://wiki.wireshark.org/Tools. The sound would only be played after the capture event occurred, and not for every packet that matched a particular filter.

Of course, you could start dumpcap.exe independent of the dumpcap.bat file and then run the batch file in "Event Only" mode, wrapping the dumpcap.bat within another batch file that just restarts it over and over. In that case, you would hear the sound after each capture event occurred, except if the capture event happened to occur between running instances.

OK, so how would you do this? First, copy the script below, copied here for convenience from this "Play invisible music with batch file?" question, and then save it as playfile.bat or some other name of your choice.

@echo off set file=track12.mp3 ( echo Set Sound = CreateObject("WMPlayer.OCX.7"^) echo Sound.URL = "%file%" echo Sound.Controls.play echo do while Sound.currentmedia.duration = 0 echo wscript.sleep 100 echo loop echo wscript.sleep (int(Sound.currentmedia.duration^)+1^)*1000) >sound.vbs start /min sound.vbs

So that you can specify any arbitrary file as an argument to the playfile.bat file, replace the following line:

set file=track12.mp3

... with this one:

set file=%~1

Next, create a file called eventaction.bat whose contents are as follows:

@call C:\path\to\playfile.bat "C:\path\to\somesound.mp3"

Now when you run the dumpcap.bat file and a capture event occurs, the sound you've chosen will be played. For more information on using the batch file, refer to the contents of the batch file itself. You can also refer to some other questions where I suggested other possible uses for it, such as:

• https://ask.wireshark.org/questions/39456/is-there-a-way-to-stop-capture-upon-http-error-404
• https://ask.wireshark.org/questions/40888/custom-stop-recording-trigger