I'd like to write a filter that shows last 5 frames from all TCP streams in the capture (5 last frames from stream #1, 5 last frames from stream #2, ...). Is it possible? Thanks in advance!
asked 20 Jun '14, 18:58
edited 21 Jun '14, 19:40
Guy Harris ♦♦
You could write a Lua script to do this, if you want to automate it. You could either (1) write a Lua script to automatically build the appropriate display filter (i.e., a huge display filter of the correct frame numbers to display) and have the script also apply the filter, or (2) write a Lua script to create a new temporary pcap file of only the appropriate packets and have the script also load that temp file.
answered 24 Jun '14, 07:06
There is a manual way to do it, but it will only work for a few connections. So, how many of those connections do you have to look at?
Unfortunately, there is no automatic way in the current code, so you'll either have to implement that yourself or use external tools.
answered 22 Jun '14, 04:38
Kurt Knochner ♦