First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Wireshark not detecting file sets

Hey,

v2.6.5

I have three files in a folder:

  • cnsfb_1.pcap
  • cnsfb_2.pcap
  • cnsfb_3.pcap

However, opening up the first file and navigating to File -> File Sets -> List Files, I do not see any of the other files listed.

I have tried this several times with different prefixes and suffices, but no joy.

swinster's avatar
1
swinster
asked 2019-01-04 18:08:00 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Using files created with a ring buffer capture option (-b) seems to work with a file set. Such files are saved in the format <name>_ddddd_ttt.<suffix>

where:

  • <name> is the capture name.
  • ddddd is the "sequence" number of the capture file, i.e. 00001, then 00002 etc.
  • ttt is the time and date of the capture, e.g. 20190104181500.
  • <suffix> is the capture file extension, e.g. pcapng.

You seem to need both the sequence number and the date\time to make the File Set feature work.

grahamb's avatar
23.8k
grahamb
answered 2019-01-04 18:23:07 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer