Wireshark-users: Re: [Wireshark-users] Filter by size then export

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Sat, 9 Jan 2010 12:45:32 -0700

On Jan 7, 2010, at 8:08 AM, Mario Valetti wrote:

I have a sample capture that I'd like to export to a file sorted by packet length. Is there an automated way to do this with tshark or manually with the GUI?

It's easy enough to filter via the GUI, but I don't see a way to export the capture keeping the new 'view'.

I don't think there is a simple way of doing this. You could probably do it with a script or some sort. One way would be to export the packets into a text format, sort it, and then use text2pcap to put them back together. Or perhaps using editcap -r to keep certain packets and then mergecap them into one file again. Wow, that could get really messy. Maybe it's a good time to file an enhancement request at https://bugs.wireshark.org/ if you need to do this often ;).

Steve