This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

analyzing, description - and marking packets/rows

0

Hi...I'm back. :)

Now I'm analyzing and describing protocol(s) traffic for purpose of my thesis/diploma. When a few rows are "over", I'd like to mark a few packets (rows) at once. How can I do that?

Combination of pressing and holding key CTRL while trying to mark more rows at once doesn't work.

BrT.

asked 29 Apr '11, 17:51

wired's gravatar image

wired
44131417
accept rate: 9%

p.s.: And I don't want to mark ALL of the packets/rows in file.

(29 Apr '11, 17:53) wired

One Answer:

1

AFAIK, the GUI allows marking multiple displayed packets at once, so just use a display filter for the packets of interest and then mark all.

For example, to mark rows/packets/frames 30 to 37:

  1. Enter frame.number >= 30 && frame.number <= 37 into the display filter textbox, and click Apply.
  2. Press Shift+Ctrl+M (or use menu "Edit > Mark All Displayed Packets")

After marking, you can return to your previous packet perusal by clearing the display filter (i.e., click Clear).

answered 29 Apr '11, 18:34

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

It works, but it's not pretty convenient because I'm analyzing step-by-step, row by row...well, better than nothing. (I'm marking to be sure what's already analyzed...and, when opening a file again, it's not marked anymore. :-()

(29 Apr '11, 18:36) wired

The packet marks are not stored in the capture file or anywhere else, so all packet marks will be lost if you close the capture file.
See Wireshark User's Guide:

(29 Apr '11, 23:55) joke

Something what should be implemented in next version(s) of Wireshark.

(30 Apr '11, 02:39) wired

Perhaps you should add it to the Wireshark WishList

(30 Apr '11, 10:41) joke

Or you could submit an enhancement bug request for it. Speaking of enhancement bug requests, bug 3059 was submitted awhile ago for being able to mark multiple frames in a range at once. I haven't looked at it in awhile, but I don't think the patch was in a state suitable for inclusion at the time. Maybe someone who is interested in this feature can work on improving it so it could be included ...

(30 Apr '11, 12:35) cmaynard ♦♦