Revision history  [back]

If I read your use-case correctly, you would like to get one line per packet with the TCP data from the packet in hex format. I think the following tshark command would suit your need:

tshark -r <file> -T fields -e frame.number -e ip.src -e ip.dst -e tcp.payload

(you can of course change the fields of interest, but the field tcp.payload will print a hexdump of the TCP segment data)