Hi, I am inserting some metadata in Optional field of Evolved Packet Block in PCAP NG file format. I want wireshark to decode and display those metadata info along with captured protocol data. Is there any provion in wireshark to do this. Or if any modification is required in wireshark, how to proceed ?? Please help. Thanks, Ambika asked 30 Nov '11, 23:18 ambika |
One Answer:
I presume you mean "Enhanced Packet Block" rather than "Evolved Packet Block"; there is no "Evolved Packet Block" in the pcap-NG specification, but there is an Enhanced Packet Block. There is currently no support for reading that information in Wireshark. In order to add that capability, you'd have to modify the API offered by the Wiretap library (in the Further discussion of this should be done on the answered 01 Dec '11, 18:43 Guy Harris ♦♦ |
Hey thanks. I have made changes in wiretap library to dump optional metadata separately to stdout for each captured packet by using Tshark. But still not sure how to pass that info to wireshark for display.
I will work on it and discuss on the wireshark-dev mailing list as you suggested.
~ ambika