This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, when merging two files (especially in chrononlogical order) it somethimes is nessecary to know from which file the corresponding line came. Is there any possibility to get that information in the columns? There's a "file" custom field, but it displays nothing.

thanks & best regards, Björn

asked 07 Aug '14, 06:09

McSlow's gravatar image

McSlow
1111
accept rate: 0%


The latest builds of mergecap usually write the originating files into the PCAPng file header comment field, so you can see it by looking at Statistics -> Summary.

permanent link

answered 07 Aug '14, 06:32

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

yes, but I'd need it for every packet, so that I can see which packet has been captured from which file or point after merging. Perhaps there's another approach to simultaneoulsy capture at several points in your network and put this in one timeline without getting confused :)

Current scenario was not too uncommon: (Multiple-)Server-Client connection, some "stuff" inbetween, some cross-connections between servers. Captured at all ends with tcpdump and merged all files in wireshark. Of course you will see a lot of packets twice or even n-times, recorded at src- and destination, but sometimes it's a mess to find out which end you're currently watching... :)

(07 Aug '14, 07:46) McSlow

You could try to do that with TraceWrangler. It allows creating PCAPng file with one dedicated interface entry per source interface, so you should end up with a file where each packet is assigned it's own interface. Then you could add a column showing interface IDs and you're there.

TraceWrangler is available at http://www.tracewrangler.com

I have to admit that I didn't test the merge features as much as I should, but time is short and I wanted to release the version for Sharkfest :-)

(07 Aug '14, 07:49) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×21

question asked: 07 Aug '14, 06:09

question was seen: 1,785 times

last updated: 07 Aug '14, 07:49

p​o​w​e​r​e​d by O​S​Q​A