Wireshark · Wireshark-users: Re: [Wireshark-users] How to filter out last 1000 frames in a quick way

[Hansang Bae <hbae@xxxxxxxxxx>]

Bin Zhou wrote:
> Sometime, I capture a big size of file, but I may need to do voip calls 
> analysis for a snapshot. For example, it is good enough for me to see 
> flows of last one thousand packets.
> If there is a quick way to filter out last 1000 frames without going to 
> the frame or packet detail level, it will be very helpful.
> Thanks for your help in advance.

The only thing you could try would be to use "editcap -c xxx" to specify 
how many packets you want per trace file (where xxx = how many packets 
you want)

Or you could try -A option to specify when you want to start seeing the 
"interesting" packets.

--

Thanks,
Hansang