Revision history [back]
Is there a field name for pcap filename?
I'm using a program that executes tshark to collect a series of fields from a large collection of pcap files. So internally it fires up tshark for each pcap file in turn.
Outputting the fields from the pcap is fine - I'm using the "-e" option to specify each of the fields names I need. Most of the time that is just fine, but I have a use-case where I also need to know the name of the pcap where there field data came from.
Is there a field name that corresponds to the pcap filename? Checked the fields reference here, but don't see anything.
If it doesn't exist I can change the program to get it to output the filename.
Is there a field name for pcap filename?
I'm using a program that executes tshark to collect a series of fields from a large collection of pcap files. So internally it fires up tshark for each pcap file in turn.
Outputting the fields from the pcap is fine - I'm using the "-e" option to specify each of the fields names I need. Most The part missing is a way to output the filename of the time that is just fine, but I have a use-case where I also need to know the name of the pcap where there field data came from.pcap.
Is there a field name that corresponds to the pcap filename? Checked the fields reference here, but don't see anything.
If it doesn't exist I can change the program to get it to output the filename.