Adding/appending packet comments in pcapng file with the Lua API

Just to make sure... you need the automatically generated comments to be stored into the pcapng file so that the resulting file could be open using any other Wireshark fresh installation and the comments would be there.

I.e. distributing a Lua post-dissector along with the pcapng file, which would add expert info or protocol fields during dissection, thus allowing packet filtering on the presence or contents of these forged fields, would not do the trick for you, correct?

My task is to label specific packets with a specific comments. Is the packet malicious or a consequences of malicious traffic and an identifier (attack_<protocol_n>:<[mal|con]_N>). My result will be fed into a machine learning algorithmus, to teach it how different attacks can look like.

@JeffMorriss I dont have to do it in Wireshark/Lua (thought it would be easy) and the comments can be written by computers, but humans have to decide weather the packet is malicious in this context or else, but the amount of data is to large to be handled by a human alone.

Just gave editcap a quick look and it seems to to do the job maybe (still need to get the speficic frame.number and feed it into editcap)

@sindy I guess i have to learn about tshark creating csv files to understand your answer.

not too much to learn, see below:

tshark -r "c:\Users\your_login\Captures\in.cap" -T fields -e frame.number -e ip.dst -E separator=, > out.csv creates the following contents of out.csv:

1,10.20.127.53
2,212.47.21.121
3,10.20.127.53
4,10.20.127.53
5,212.47.21.121
6,212.47.21.121
...

So your Lua post-dissector would create a single field (named e.g. classification) for those packets which are worth it, and you would replace -e ip.dst with -e classification in the example above. For those packets for which the Lua script would create the field, its value would be output to the file after the packet number; for the rest, only the packet number would be printed. By adding -Y classification, you would prevent these "packet number only" lines from being written to the output file.

Or, vice versa, you could let the Lua post-dissector create the classification field for every single packet, except that it would contain some special "don't care" value for packets which the expert system should ignore. In that case, you could omit the -e frame.number and you would get just the classification string for each packet, so the merging script could simply be reading one packet from the pcap file and one line from the list of classifications at a time, rather than keep track of packet numbers.