Wireshark · Wireshark-dev: Re: [Wireshark-dev] Annotation(comments) of captures and interfaces (pcapng).

[Guy Harris <guy@xxxxxxxxxxxx>]

On Feb 22, 2012, at 9:05 AM, Anders Broman wrote:

> Spending some time on the basics for this I have a couple of questions on how to proceed.
>  
> Live captures:
> - To annotate a capture when we start it we would have to fill in pcapngs Section Header Blocks (SHB) option comment. This has to be done trough dumpcap -right?

Or, in Wireshark, through an option to annotate the capture after you've made it; File -> Save would be activated, and it'd write out a new version of the file with a comment option in the SHB.

>   In order to do that a new argument is needed Use -C "This capture was made to prove that annotating captures work"?
>   Where to put the GUI stuff for it?

For annotating the capture when you make the capture, I'd have a field in the Capture Options dialog, activated if the capture is being done as a pcap-NG file rather than a pcap file.
 
> - It cold be nice to have a permanent comment attached to an interface, fits in the Interface Description Blocks(IDB) comment field, does this also require an option to dumpcap?

...and, in Wireshark, a dialog of some sort to let you add comments and save the capture out.