Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Compare two wireshark

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 02 Jul 2010 08:03:11 +0200
Hi,

Well, I guess you could mergecap chronologically the two files, then tshark the result and see what that brings you, depending on where in the protocol you want to spot the differences.

Thanks,
Jaap

On 07/02/2010 07:29 AM, Abhishek Gupta wrote:
Can I achieve 3^rd  possibility using command line.?

*From:* wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] *On Behalf Of *Jaap Keuter
*Sent:* Thursday, July 01, 2010 7:13 PM
*To:* Community support list for Wireshark
*Subject:* Re: [Wireshark-users] Compare two wireshark

Hi,

Compare in what sense?

Should there be a binary compare? (unlikely)
Should there be a packet compare? (maybe, then you can load both files
and try to delete duplicates)
Should there be a SIP compare? (possible, then you could load both
captures and use VoIP calls and show graph)

Thanks,
Jaap

On Thu, 1 Jul 2010 17:18:03 +0530, Abhishek Gupta
<abhishek@xxxxxxxxxxxx> wrote:

    Hi,

    I have two PCAP file, both have SIP packets. Now I want to camper
    these pcap files.