This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Print Packet Comments?

0

Is there a way to export or print a report of all the packet comments of a capture without everything else in the packet?

Thanks, Travis

asked 20 Mar '14, 16:02

Rooster_50's gravatar image

Rooster_50
238●9●12●18
accept rate: 15%

3 Answers:

0

After doing some more searching, I noticed under STATISTICS | Comment Summary that you are given a text printout of all the trace and packet comments. This is exactly what I was looking for.

I guess I just needed to look a bit harder. I was stuck within the FILE and EDIT menus and never gave the STATISTICS menu a thought.

Travis

answered 20 Mar '14, 19:40

Rooster_50's gravatar image

Rooster_50
238●9●12●18
accept rate: 15%

1

You could add a custom column containing the packet comments: Unfold the top section of any packet, select the line containing the comment and use the popup menu to "Apply as Column".

Then export the packet list to csv. That list can then be printed with any editor (or spreadsheet tool) of your choice.

answered 20 Mar '14, 16:24

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Thanks Jasper....Thats a good idea.

I also just now found under: STATISTICS | Comment Summary

I guess I just needed to look a bit harder. I was stuck under the FILE and EDIT menus.

Thanks again for your added info.

Travis

(20 Mar '14, 16:33) Rooster_50

1

Another solution would be to use tshark. For example:

tshark -r file.pcapng -T fields -E header=y -e frame.number -e frame.comment

... and if you only want the frames that contain comments, then you can use something like:

tshark -r file.pcapng -Y frame.comment -T fields -E header=y -e frame.number -e frame.comment

answered 20 Mar '14, 16:42

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

edited 20 Mar '14, 16:45

cmaynard,

Thanks for the additional tip using tshark.

(20 Mar '14, 19:42) Rooster_50