I made some recherché, but couldn’t find any information to this topic. Is there a possibility to know (special bit for example), whether the user stopped, started the capture or opened Wireshark
new?
There is nothing available to dissectors to indicate whether the packets are coming from a live capture or a capture done in the past, and thus there is nothing to indicate the status of a live capture.
That would be a great help for my dissector.
Why? What would you do differently, depending on whether you have a live capture and, if so, what the status of that capture is? |
