Tshark "-Tfields" option not working

Tshark Version 2.6.3 (Windows 64-bit version)

I am trying to export the "data.txt" field to a text file with TSHARK. When I attempt the following...

tshark -r filename.pcapng -Tfields -e data.txt >> dataprint.txt

I get the following error...

tshark: Some fields aren't valid: data.txt

Is this a limitation of the current version of Tshark where data.txt is not a field that can be extracted with the TFields parameter? In the default profile, I have "Show data as text" checked in the protocol preferences.

Thanks,

Travis

As the error message indicates, there is no data.txt field. I think the field you're looking for is data.text.

You can check/verify which fields are valid for which version of Wireshark you're using by referencing the online Display Filter Reference page. For example, the valid data fields are currently listed as:

Field name  Description     Type    Versions
data.data   Data    Sequence of bytes   1.0.0 to 2.6.3
data.len    Length  Signed integer, 4 bytes     1.2.0 to 2.6.3
data.md5_hash   Payload MD5 hash    Character string    1.6.0 to 2.6.3
data.text   Text    Character string    1.4.0 to 2.6.3
data.uncompressed.data  Uncompressed Data   Sequence of bytes   2.6.0 to 2.6.3
data.uncompressed.len   Uncompressed Length     Signed integer, 4 bytes     2.6.0 to 2.6.3

11.1k

cmaynard

answered 2018-09-18 15:06:31 +0000

edit flag offensive 0 remove flag delete link

Comments

Too long of week already and stared at it way too long to realize the rookie syntax mistake.

Thanks Cmaynard!

Rooster_50 (2018-09-18 15:37:06 +0000) edit

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Tshark "-Tfields" option not working edit

Tshark Version 2.6.3 (Windows 64-bit version)

Comments

1 Answer

Comments