This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Compare Two Captures Feature Missing in WireShark 2.0?

0

Accord to the docs: https://www.wireshark.org/docs/wsug_html_chunked/ChStatCompareCaptureFiles.html

there should be a feature to compare two captures. I have searched high and low through the software and I am unable to find it anywhere. Was this feature removed? Am I blind?

asked 12 Apr '16, 13:48

tyler01's gravatar image

tyler01
6113
accept rate: 0%


2 Answers:

2

It's probably a feature that has not yet been ported to 2.x - but if you're interested in comparing two captures, take a look at the "Workbench" tool (previously named TraceMatcher) available at Tribelab:

https://community.tribelab.com/enrol/index.php?id=15

You'll need to create an account before being able to access the page and download it, but its free.

answered 12 Apr '16, 14:53

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

I noticed from the TribeLab stats that there has been a burst of interest in this post so I thought I should provide an update.

The Workbench Proof of Concept that Jasper referred to had packet matching and Syncro capability (keeping two traces in step). The new production release of Workbench (still free) doesn't yet have this capability. However, we expect to make this feature available again within the next two months.

answered 07 Jan '17, 10:32

PaulOfford's gravatar image

PaulOfford
131283237
accept rate: 11%