Re: Filter by size then export

[Stephen Fisher <steve () stephen-fisher com>]

On Jan 7, 2010, at 8:08 AM, Mario Valetti wrote:

> I have a sample capture that I'd like to export to a file sorted by  
> packet length.  Is there an automated way to do this with tshark or  
> manually with the GUI?
>
> It's easy enough to filter via the GUI, but I don't see a way to  
> export the capture keeping the new 'view'.

I don't think there is a simple way of doing this.  You could probably  
do it with a script or some sort.  One way would be to export the  
packets into a text format, sort it, and then use text2pcap to put  
them back together.  Or perhaps using editcap -r to keep certain  
packets and then mergecap them into one file again.  Wow, that could  
get really messy.  Maybe it's a good time to file an enhancement  
request at https://bugs.wireshark.org/ if you need to do this often ;).


Steve

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe