This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Options present in IDB block in Pcapng format

0

I am unable to view the options added for Interface Description Block (IDB) for the below options: - if_name - if_speed Please let me know where this options would be displayed on wireshark. Thanks, Subhash

asked 18 Oct '17, 22:41

subhashmohan's gravatar image

subhashmohan
11●3●3●6
accept rate: 0%

One Answer:

0

The interface name is expressed in the field frame.interface_name. The interface speed I'm not sure that can be shown somehow.

answered 18 Oct '17, 23:24

Jaap's gravatar image

Jaap ♦
11.7k●16●101
accept rate: 14%

I don't think the if_speed option is written to the IDB by any capture tool so far. I checked some of my pcapng files and they don't have it.

@subhashmohan: you can use TraceWrangler to show the PCAPng structure by adding a pcapng file to the file list, select it and go to the "PCAPng Structure" tab at the bottom. TraceWrangler is available here: https://www.tracewrangler.com

(19 Oct '17, 00:29) Jasper ♦♦

Wireshark can also show the capture file structure (not sure if ALL formats are supported) using the View | Reload as File Format/Capture menu item.

This is also bound to Ctrl + Shift + F, but for me at least, that seems only to work in one direction, packets -> File Format.

(19 Oct '17, 02:38) grahamb ♦

Thanks for your answers

(26 Oct '17, 00:32) subhashmohan