CODEWITHSUNDEEP
wiresharktsharknetwork-analysis
Hemulin
Hemulin

Reputation: 23

tshark - help finding tshark 1.6.7 field names

Trying to convert pcap to txt and showing specific fields.

On thsark 1.12.4 this works:

tshark -nr "input_file.pcap" -E header=y -e frame.number -e frame.time -e ip.src -e ip.dst -e _ws.col.Protocol -e _ws.col.Info -e data -T fields -V "tcp or udp" > "output_file.txt"

Sadly, on tshark 1.6.7 (which is kind of mendatory) the protocol and info cols don't show.

I've tried all the combinations I could find online: _ws.col.Info, _ws.col.info, col.Info, col.info, Info, info.

Couldn't find anything else.

Any suggestions how to make those cols to show in the ouptput txt file?

Best.

Upvotes: 0

Views: 1002

Answers (1)

user862787
user862787

Reputation:

Any suggestions how to make those cols to show in the ouptput txt file?

Talk to whoever is in charge of making 1.6.7 mandatory, convince them not to make it mandatory, and then upgrade to a newer version of Wireshark. That feature - the ability to show columns with -T fields - didn't exist in 1.6.x; it was added later, in the 1.10 release, as the Bugzilla entry for the enhancement request for it indicates.

Upvotes: 2

Related Questions