This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm trying to debug something, a flaky Bluetooth stream, that has a lot of data and relatively rare issues. Ideally, what I'd like to be able to do is to start Wireshark running and then have a button I can press that will, in real time, insert markers in to the packet capture stream. Then I could go back and look carefully at the traffic around the time of events.

Does that exist? And if not, what's the best way to record markers like that and make use of them in Wireshark?

asked 20 Sep '14, 11:44

wpietri's gravatar image

wpietri
16114
accept rate: 0%


Nothing such as that exists in Wireshark.

It might be a useful enhancement. The pcap file format doesn't have any mechanism to support that, but the pcap-ng format, which is the default, is extensible, so we could add, for example, an "external event" block type that contains user-specified text.

Enhancement requests can be filed at the Wireshark Bugzilla.

permanent link

answered 20 Sep '14, 15:57

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks! That's helpful; there's so much good stuff in Wireshark I have a hard time telling when something definitely isn't there. For now I think I'll just make a little script that logs keypresses with fine-grained timestamps. But that would be a cool feature.

(21 Sep '14, 14:42) wpietri

If you file an enhancement request, that'll at least make a record of it in the bug database, so that people can find it, discuss it, and work on it more easily; please do so if you'd like to have the feature.

(21 Sep '14, 15:02) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×7
×3

question asked: 20 Sep '14, 11:44

question was seen: 1,152 times

last updated: 21 Sep '14, 15:02

p​o​w​e​r​e​d by O​S​Q​A