This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a way to export or print a report of all the packet comments of a capture without everything else in the packet?

Thanks, Travis

asked 20 Mar '14, 16:02

Rooster_50's gravatar image

Rooster_50
23891218
accept rate: 15%


After doing some more searching, I noticed under STATISTICS | Comment Summary that you are given a text printout of all the trace and packet comments. This is exactly what I was looking for.

I guess I just needed to look a bit harder. I was stuck within the FILE and EDIT menus and never gave the STATISTICS menu a thought.

Travis

permanent link

answered 20 Mar '14, 19:40

Rooster_50's gravatar image

Rooster_50
23891218
accept rate: 15%

You could add a custom column containing the packet comments: Unfold the top section of any packet, select the line containing the comment and use the popup menu to "Apply as Column".

Then export the packet list to csv. That list can then be printed with any editor (or spreadsheet tool) of your choice.

permanent link

answered 20 Mar '14, 16:24

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks Jasper....Thats a good idea.

I also just now found under: STATISTICS | Comment Summary

I guess I just needed to look a bit harder. I was stuck under the FILE and EDIT menus.

Thanks again for your added info.

Travis

(20 Mar '14, 16:33) Rooster_50

Another solution would be to use tshark. For example:

tshark -r file.pcapng -T fields -E header=y -e frame.number -e frame.comment

... and if you only want the frames that contain comments, then you can use something like:

tshark -r file.pcapng -Y frame.comment -T fields -E header=y -e frame.number -e frame.comment
permanent link

answered 20 Mar '14, 16:42

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

edited 20 Mar '14, 16:45

cmaynard,

Thanks for the additional tip using tshark.

(20 Mar '14, 19:42) Rooster_50
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×5

question asked: 20 Mar '14, 16:02

question was seen: 3,548 times

last updated: 20 Mar '14, 19:42

p​o​w​e​r​e​d by O​S​Q​A