Hi...I'm back. :) Now I'm analyzing and describing protocol(s) traffic for purpose of my thesis/diploma. When a few rows are "over", I'd like to mark a few packets (rows) at once. How can I do that? Combination of pressing and holding key CTRL while trying to mark more rows at once doesn't work. BrT. asked 29 Apr '11, 17:51  wired |
One Answer:
AFAIK, the GUI allows marking multiple displayed packets at once, so just use a display filter for the packets of interest and then mark all. For example, to mark rows/packets/frames 30 to 37:
After marking, you can return to your previous packet perusal by clearing the display filter (i.e., click Clear). answered 29 Apr '11, 18:34  helloworld It works, but it's not pretty convenient because I'm analyzing step-by-step, row by row...well, better than nothing. (I'm marking to be sure what's already analyzed...and, when opening a file again, it's not marked anymore. :-() (29 Apr '11, 18:36) wired The packet marks are not stored in the capture file or anywhere else, so all packet marks will be lost if you close the capture file. (29 Apr '11, 23:55) joke Something what should be implemented in next version(s) of Wireshark. (30 Apr '11, 02:39) wired Perhaps you should add it to the Wireshark WishList (30 Apr '11, 10:41) joke Or you could submit an enhancement bug request for it. Speaking of enhancement bug requests, bug 3059 was submitted awhile ago for being able to mark multiple frames in a range at once. I haven't looked at it in awhile, but I don't think the patch was in a state suitable for inclusion at the time. Maybe someone who is interested in this feature can work on improving it so it could be included ... (30 Apr '11, 12:35) cmaynard ♦♦ |
p.s.: And I don't want to mark ALL of the packets/rows in file.