|
I want to print the information that I need of a PCAP file. I know that I can use the command "tshark -e": My question is: How can I display the "id source port", "id destination port"? And for "-e data", is it possible to display just the first 8 bytes? |
|
I guess you are interested in If you need the UDP source port, replace
Unfortunately, this is not possible. However, you can limit the total packet size with editcap, effectively getting only 8 bytes of data, at least in the most cases. Capture
Truncate
Print
Regards Thanks you. I tried "-e udp.srcport", that works!! I have another question, that will be so nice if you can help me again. If i want to print the ID, is there something like "-e id.src, -e id.dst" ? I tried this command, but it doesn't work. And for "-e frame.time", i just want to display "Mai 3, 2012 10:00:00", not like "Mai 3, 2012 10:00:00:958252000", can I? Regards
(03 May '12, 00:59)
Alice
What is the element you are calling "id"? To see (most) of the element names that you can supply to There are a number of other frame.timeXXX fields, you could use but they all display fractional seconds. The format you require doesn't appear to be supported, and the
(03 May '12, 02:29)
grahamb ♦
what do you meand by "ID"? Is it the IP ID? If yes, please use -e ip.id"
(03 May '12, 03:59)
Kurt Knochner ♦
|
