This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can I add a new column with the difference (or another arithmetic operation) of values from two other columns?

Or maybe with the help of tshark it could be done?

asked 30 Jul '15, 05:20

abatian's gravatar image

abatian
6113
accept rate: 0%

edited 30 Jul '15, 05:27


No. Wireshark always displays values taking from one frame, and one frame only. So if the dissectors do not provide such a calculated value (e.g. "TCP Next expected Sequence number") you cannot filter on it neither build a column based on that filter.

Most of us use the export function "Export Packet Dissections" -> "as CSV" -> "Packet summary line only" to export the packet list to CSV, and then run Excel (or any other spreadsheet software) to do the calculations for us.

permanent link

answered 01 Aug '15, 10:03

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×13
×4
×1

question asked: 30 Jul '15, 05:20

question was seen: 1,865 times

last updated: 01 Aug '15, 10:03

p​o​w​e​r​e​d by O​S​Q​A