Wireshark-bugs: [Wireshark-bugs] [Bug 9234] Modify value in a protocol container

Date: Sun, 10 Nov 2013 20:55:52 +0000

Comment # 10 on bug 9234 from
In concept, I think something like this could work:

tshark -r infile.pcap -A ip.host "/10.1.1.1/10.2.2.2/" -w outfile.pcap

That would take the value in any container matching ip.host in infile.pcap,
replace any occurrence of 10.1.1.1 with 10.2.2.2, then save the result to
outfile.pcap. The idea would be to make it extensible to any container tshark
can dissect, with the flexibility of sed.

The sed syntax there is just a concept. Even replacing all values with 0 for a
matched entry would have value.


You are receiving this mail because:
  • You are watching all bug changes.