This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Adding Comments to a Packet

0

Does Wireshark have a way to enter a comment on a specific packet for future reference? (e.g. Here is the start of the issue.)

asked 05 May '11, 08:17

CarlT's gravatar image

CarlT
1●2●2●2
accept rate: 0%

edited 05 May '11, 08:39

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142

One Answer:

1

The pcapng file format supports this, but Wireshark itself does not yet have good support for it. A bug has been filed for it though, namely bug 3096.

answered 05 May '11, 08:43

cmaynard's gravatar image

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Awesome, glad it's already in the bug list. Thanks for the update and reference.

(05 May '11, 08:47) CarlT

A similar bug 6229 has been fixed on wireshark 1.6.2 release related to reading and displaying comment option in wire shark.

I tried but not able to view the comment field from pcapng file using wireshark 1.6.3 release. Any idea ??

(06 Jan '12, 01:35) ambika

Bug 6229 is NOT a similar bug; that bug is not that the comment can't be read, it's that Wireshark mishandled the comment in a way that meant that it didn't properly return the packet data for a frame with comments, meaning Wireshark wouldn't even properly show the packet data.

The only way you're going to be able to view the comment field is to wait for bug 3096 to be fixed and then use a version of Wireshark with that fix.

(06 Jan '12, 02:13) Guy Harris ♦♦