Wireshark · Wireshark-users: Re: [Wireshark-users] embed comments and notes into trace?

[Gerald Combs <gerald@xxxxxxxxxxxxx>]

Alan Jay Weiner wrote:
> Does anyone know of a protocol I can use in this way?  It seems to me I
> remember something like this, but I’ll be darned if I can find it now.  I
> can mis-use something - send a DNS query to "starting doing
> something-or-other" but the info line will have other cruft on it ("standard
> query A starting doing something-or-other").

Instead of using a dummy protocol, you might want to use a file format that lets
you add comments directly to packets, such as pcap-ng:

http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
http://wiki.wireshark.org/Development/PcapNg

Experimental support is currently in Wireshark, in wiretap/pcapng.[ch].