The default settings provide filter on MAC addresses, udp dest ports, tcp dest ports and an additional filter expression. This generates and executes Wireshark-tshark based filter expressions and executes them to create a new pcap files with only the filter matching frames.

Filter pcap files assistant (mainly to reduce size and ease further analysis).

Selecting an event reveals the frames close to that reception time (even the frames are not part of the current display filter).

Tree-view with freely-configurable events based on display filter syntax allows to provide a kind of structure of the frames captured.

will propose to adjust/sync the selected line to the received one. If a time was received already the adjust-time.Manual offset for the time via context menu item adjust-time.Automatic time-sync based on freely-configurable events that get broadcasted to other extensions so that time shifts between documents are adjusted automatically.Calculates time for each frame based on timestamp and broadcasts the time to the other Time sync extensions so that they reveal the fitting time ranges.Display filter with known syntax from wireshark.run/sharkd - =1.46 directly open cap/pcap/pcapng files.

If you install from source (git clone cd wireshark mkdir build cd build cmake -DBUILD_wireshark=OFF. With Ubuntu 20.04-LTS installing package 'tshark' seems to be sufficient. Note: Under Linux® the default Debian package doesn't install 'sharkd'. Extracting the wireshark folder into any local folder and pointing the sharkdFullPath setting to it seems to work (so keeping the regular installation untouched). Note: Currently I do find 'sharkd' for Windows only as part of the Wireshark Portable packages win64/WiresharkPortable_latest. This version requires a wireshark installation >=v3.5! If you need an older wireshark version you need to use v1.7.1 of this extension! Note: Wireshark changed the jsonrpc for sharkd with version 3.5. So Wireshark (incl sharkd) need to be locally installed. Note: It acts mainly as a UI to a local Wireshark™ installation. Note: The time-sync feature works well with extension and for DLT (diagnostic log and trace) files. It allows as well to 'filter' (create smaller) pcap/pcapng files with a freely-configurable, multi-steps assistant. This Visual Studio Code(tm) extension adds support to open pcap/network files.

Wireshark libpcap