Wireshark mailing list archives
Annotation(comments) of captures and interfaces (pcapng).
From: Anders Broman <anders.broman () ericsson com>
Date: Wed, 22 Feb 2012 18:05:01 +0100
Hi, Spending some time on the basics for this I have a couple of questions on how to proceed. Live captures: - To annotate a capture when we start it we would have to fill in pcapngs Section Header Blocks (SHB) option comment. This has to be done trough dumpcap -right? In order to do that a new argument is needed Use -C "This capture was made to prove that annotating captures work"? Where to put the GUI stuff for it? - It cold be nice to have a permanent comment attached to an interface, fits in the Interface Description Blocks(IDB) comment field, does this also require an option to dumpcap? For example: "Captures of the mirror interface of XXX". At least for windows it should be possible to add if_speed to the IDB as well. Any one interested in doing parts of this? Regards Anders
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Annotation(comments) of captures and interfaces (pcapng). Anders Broman (Feb 22)
- Re: Annotation(comments) of captures and interfaces (pcapng). Guy Harris (Feb 22)