I can see that wireshark successfully dissects QUIC packets. Is this possible using tshark as well ? If yes, what command will give the desired result?
Thanks :)
Wireshark and tshark use the same dissection code, so tshark can output the same dissection results as Wireshark. Normally the arguments you give to tshark are the capture file to use and any display filters required, see the tshark man page for more details.
What is the result you want?
Essentially, I want to view the packet in the same format that it gets displayed in wireshark i.e. frame details followed by IP details followed by UDP details followed by QUIC details.
Then you would use the -V output option, (uppercase V), e.g.
tshark -r path\to\my\capture.pcapng -V
On Windows you may also have to prefix the command with the path to tshark.exe, e.g.
"C:\Program Files\Wireshark\tshark.exe" ...
Comments