mozillazg / ptcpdump

Process-aware, eBPF-based tcpdump
MIT License
573 stars 41 forks source link

no comment info in pcpa file #163

Closed wangzhankun closed 1 month ago

wangzhankun commented 1 month ago

Describe the bug

When the output is stdout, ptcpdump can show the comment info. But when try to output to pcap file, I cannnot find comment info in wireshark.

 ./ptcpdump -i eth0 -v # stdout
 ./ptcpdump -i eth0 -v -w test.pcap # to pcap file
image image

Environment

Additional context

mozillazg commented 1 month ago

@wangzhankun Thanks for reporting. Only the pcapng format support comment. Please try again with pcapng file:

 ./ptcpdump -i eth0 -v -w test.pcapng