Is there any due date (or plans at all) to enhance the export objects for TSHARK? Currently the UI provides lots of critical data such as the packet number, file name, content type etc But this isn't reflected in TSHARK
Thanks in advance
There are no "plans" as such, folks work on whatever they need at the time.
Work in progress can be seen on the Wireshark Gerrit site.
Requests for changes can be added to the Wireshark bugzilla site as enhancement requests, please check for an existing request before adding a new one.
Any display filter field can be output by tshark, and some objects can be exported, e.g.
tshark --export-objects help
tshark: The available export object types for the "--export-objects" option are:
dicom
http
imf
smb
tftp
but your question isn't clear as it mixes fields, e.g. packet number and filename, can you clarify what output you''re looking for?
Thanks for your answer My intention is that when exporting the objects with TSHARK we dont get all data we see in the UI export objects UI So we dont know from which file is related to which packet/IP
The "Export Object" mechanism - in both Wireshark and TShark - is intended to save the raw content of files transferred over a network protocol; that means it can't put that information into the file itself.
It could put it into the name of the file into which the object is saved but that's it. If you'd like it to do so, make a request for a change, as @grahamb said.
I'll add a request than thank you!
Add a Feature request https://bugs.wireshark.org/bugzilla/s... Thanks everyone
Comments