Revision history  [back]

Do you know a way of doing it with tshark ?

Text dissections are written by TShark to the standard output, so there is no mechanism in TShark to do that.

You could have a program that reads the -T json output of TShark and writes that out in separate files; that program would have to understand the JSON output to an extent necessary to avoid splitting a single packet's JSON between files.