Hi i would like to know if it's possible to add extra personalized labels to pcap file, once they are captured and stored. I think this can be done once transforming the pcap file to other fomats such as json and csv, while is there anyway i can add directly extra arbitrary information/fields to pcap files? Thanks a lot.
Go to Statistics->file properties, at the bottom you can add and save file comments. It shold be possible to do with tshark as well check out the manual.
Note you can also store a comment for each packet; right click a packet in the list and choose "Packet Comment..."
If you save the file, it'll have to be written out as a pcapng file, not a pcap file; pcap files don't support comments, but pcapng files do. ("pcap" isn't a generic term for packet captures, it's a specific term for a particular file format. "Capture file" is the proper generic term.)
Thanks a lot :)
Comments