Can I add a new column with the difference (or another arithmetic operation) of values from two other columns? Or maybe with the help of tshark it could be done? asked 30 Jul '15, 05:20  abatian edited 30 Jul '15, 05:27 |
One Answer:
No. Wireshark always displays values taking from one frame, and one frame only. So if the dissectors do not provide such a calculated value (e.g. "TCP Next expected Sequence number") you cannot filter on it neither build a column based on that filter. Most of us use the export function "Export Packet Dissections" -> "as CSV" -> "Packet summary line only" to export the packet list to CSV, and then run Excel (or any other spreadsheet software) to do the calculations for us. answered 01 Aug '15, 10:03  Jasper ♦♦ |
