THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 1
cmaynard's avatar
11.1k
cmaynard
answered 2020-09-30 00:36:35 +0000

After merging .pcapng files into another .pcapng file, you ought to be able to determine the file from which the packets originated using the frame.interface_id field, which you can see if you expand the Frame details in the Packet Details Pane and which you can apply as a column. That would, I think, negate the need to set the frame.comment field.

See also these related questions and associated answers:

  • https://ask.wireshark.org/question/1804/how-to-identify-frames-from-which-merged-capture/
  • https://ask.wireshark.org/question/6030/how-can-i-see-the-interface-name-and-dlt-for-a-packet-in-wireshark/