wireshark_filter_save
Filter network packets from a PCAP file using Wireshark display filters and save the filtered results to a new file for focused analysis.
Instructions
Filter packets from a pcap and save to a new file.
Args: input_file: Source pcap file output_file: Destination pcap file display_filter: Wireshark display filter (e.g. "http.request.method == POST")
Returns: Success message or error JSON
Errors: FileNotFound: input_file does not exist ExecutionError: Filter failed
Example: wireshark_filter_save("big.pcap", "http_only.pcap", "http")
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| input_file | Yes | ||
| output_file | Yes | ||
| display_filter | Yes |