Wireshark-users: Re: [Wireshark-users] How to filter out last 1000 frames in a quick way

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Sat, 05 Jul 2008 23:11:33 -0400

Bin Zhou wrote:

Sometime, I capture a big size of file, but I may need to do voip calls analysis for a snapshot. For example, it is good enough for me to see flows of last one thousand packets. If there is a quick way to filter out last 1000 frames without going to the frame or packet detail level, it will be very helpful.

Thanks for your help in advance.

The only thing you could try would be to use "editcap -c xxx" to specify how many packets you want per trace file (where xxx = how many packets you want)

Or you could try -A option to specify when you want to start seeing the "interesting" packets.

--

Thanks,
Hansang