First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

write the name of fields instead of number in tshark

hi, i want to write the name of fields instead of number in tshark.is it possible? for example if i use this command:

tshark -r test.pcap -T fields -e eth.type

in the output i see 

Type:0x8021

but i want to see the name of this field .i want to see 

Type: PPP IP Control Protocol (0x8021)
ghader's avatar
63
ghader
asked 2018-03-29 13:46:07 +0000, updated 2018-03-29 13:46:48 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

1

You can try specifying the column output instead of the per-field output. For example:

*nix:

tshark -r test.pcap -o 'gui.column.format:"Eth Type","%Cus:eth.type"'

Windows:

tshark -r test.pcap -o "gui.column.format:\"Eth Type\",\"%Cus:eth.type\""

Run tshark -G column-formats and/or refer to the tshark man page for additional help with specifying column formats.

cmaynard's avatar
11.1k
cmaynard
answered 2018-03-29 17:37:27 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer