How to go to next colored packet

I want to navigate to the next colored packet within the displayed packets in Wireshark. For example, I have colored the packets based on the time interval between them, and I want to only show packets that satisfy the original filtering conditions and have a time interval of more than 1 second. However, these colored packets cannot be filtered using a new filter because it would change the filtering results and not show the desired content. But now, I am unable to navigate based on the coloring. How can I achieve this?

Indeed filtering on time-differences is difficult as it changes the time-differences. For udp and tcp conversations, there are delta times available within a stream, which do not change by filtering. Have a look at the fields tcp.time_delta and udp.time_delta.

If that does not help, the answer to your original question to go to the next colored packet is to use the find function and then use the display filter option (which is the default) and then look for frame.coloring_rule.name == "TCP RST" (change the "TCP RST" to the name of your relevant color filter).

18.5k

SYN-bit

answered 2023-07-13 08:14:19 +0000

edit flag offensive 0 remove flag delete link

Comments

Thanks, it works well.

zhaoxian (2023-07-13 10:49:59 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

How to go to next colored packet edit

Comments

1 Answer

Comments