THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 1
cmaynard's avatar
11.1k
cmaynard
answered 2018-03-29 17:37:27 +0000

You can try specifying the column output instead of the per-field output. For example:

*nix:

tshark -r test.pcap -o 'gui.column.format:"Eth Type","%Cus:eth.type"'

Windows:

tshark -r test.pcap -o "gui.column.format:\"Eth Type\",\"%Cus:eth.type\""

Run tshark -G column-formats and/or refer to the tshark man page for additional help with specifying column formats.