Is is possible to set the comment for an individual packet using tshark? I see in the man page this can be done for the capture comment with --capture-comment <comment> but is there a way to specify an individual packet by packet number?
asked 21 Jun '15, 10:37
No, you can't do that with tshark (not implemented). However, you can add packet level comments in Wireshark (right click a frame and choose "Packet comment") and then save the file as a pcapng to preserve the comments.
answered 21 Jun '15, 10:51
Kurt Knochner ♦
edited 21 Jun '15, 10:53