First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

How to export part of a TCP stream to a .pcapng file?

How to export part of a TCP stream to a .pcapng file?

markleo's avatar
7
markleo
asked 2022-06-20 01:59:48 +0000
grahamb's avatar
23.8k
grahamb
updated 2022-06-20 04:47:12 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Apply a display filter to show just the packets you want to export. From your image, it looks like you want packets 1624 through 1628. Because the packet numbers are continuous, with no gaps, you could use this display filter:

frame.number > 1623 && frame.number < 1629

Then go to File > Export Specified Packets. Browse to where you want to save the file. Enter the file name in the "File name" field. Check that the pcapng file type is selected in the "Save as type" field. That's the default, so it should already be selected. Under "Packet Range," "All packets" should be selected and "Displayed" should be selected. Again, those are the defaults, so they should already be selected. Click "Save" to save the new file.

Note that the original packet numbers will not be preserved, so packets 1624 - 1628 from the original file will be packets 1 - 5 in your new file.

If the packets you wanted to save were not in a continuous range, you could mark the packets of interest (Mark functions are on the View menu), and then on the Export Specified Packets dialog, instead of "All packets" you could select "Marked packets only."

Jim Aragon's avatar
7.5k
Jim Aragon
answered 2022-06-20 16:16:11 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer