|
Can I add a new column with the difference (or another arithmetic operation) of values from two other columns? Or maybe with the help of tshark it could be done? |
|
No. Wireshark always displays values taking from one frame, and one frame only. So if the dissectors do not provide such a calculated value (e.g. "TCP Next expected Sequence number") you cannot filter on it neither build a column based on that filter. Most of us use the export function "Export Packet Dissections" -> "as CSV" -> "Packet summary line only" to export the packet list to CSV, and then run Excel (or any other spreadsheet software) to do the calculations for us. |
