I am parsing a large wireshark packets using pyshark similar to:
import pyshark
import struct
import binascii
cap = pyshark.FileCapture('C:/1-work/wire/capture_11_9_23.pcapng',use_json=True)
I am parsing the udp payload and want to select specific packets and save them in a new wireshark compatible file preserving the "time" information and being able to look at the packets in wireshark.
I tried to write packets in file using
f.write(cap[0].get_raw_packet())
with
cap =pyshark.FileCapture(filein,display_filter='eth',use_json=True, include_raw=True)
but the file is not wireshark compatible. I think it is the raw packet and it is not wireshark compatible.