This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I have client and server side captures, and I have merged them to find the matching Identification ID's. I used that as column and tested. There are about 100k of packets where am I have hard time to find the packets matching. I used Statistics > Compare.. but did not get good information.

Needed your inputs to achieve this.

Regards Prabh

asked 21 Feb '14, 09:40

prabh's gravatar image

prabh
11112
accept rate: 0%

Why are you trying to find the matching IP IDs? What is it that you are ultimately trying to accomplish?

(21 Feb '14, 13:07) Jim Aragon

You can print the IP IDs with tshark and then use a script (perl, python, whatever) or a spreadsheet software to find duplicate values.

tshark -nr input.pcap -T fields -e frame.number -e ip.id -E header=yes -E separator=; > ip_id.txt

Sample output:

frame.number;ip.id
1;0xf038
2;0x95c0
3;0xf039
4;0x95c0

Regards
Kurt

permanent link

answered 24 Feb '14, 10:47

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 24 Feb '14, 10:48

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×7

question asked: 21 Feb '14, 09:40

question was seen: 974 times

last updated: 24 Feb '14, 10:48

p​o​w​e​r​e​d by O​S​Q​A