Revision history  [back]

In a nutshell, use a display filter (-Y) instead of a read filter (-R), e.g.:

tshark -r capture.pcap -T fields -e frame.number -e ssl.handshake.extensions_server_name -2 -Y ssl.handshake.extensions_server_name

Refer to the tshark man page for more details.