Tracediff will print a details for each packet that differs between the two capture file. Wireshark Download the latest stable version See also: Wireshark Alternatives for packet sniffing Get The Ultimate Wireshark eBook for FREE Learn everything there is to know about Wireshark. If you're not against installing a new tool, there are several that can do that for you: Diffing the two text files reveals that file2.pcap contains 2 more packets. You might need to dump different field values. In our case this will be Ethernet, as we’re currently plugged into the network via an Ethernet cab.

The very first step for us is to open Wireshark and tell it which interface to start monitoring. Here I dump a few field values for each packet that, in my case, are sufficient. By using Wireshark, we will see what data we can find on the network relating to any network communications. $ tshark -r file2.pcap -Tfields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport > file2.txt Method 2: Compare the text dumps $ tshark -r file1.pcap -Tfields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport > file1.txt Here, I have a 4 packets difference because the capture of file2 was started before file1's. $ capinfos file2.pcap | grep 'Number of packets:' If you know for sure that the receiver didn't receive packets from another sender, you can simply count the number of packets in each capture file to get the number of dropped packets: $ capinfos file1.pcap | grep 'Number of packets:'

Wireshark download file