This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark pdml value

0

Hi guys. I'm trying to extract multimedia content from an MMSE dumped pcap file from command line (Bash - Linux RHEL5).

Well, with command:

tshark -R "mmse" -r mms.pcap -T pdml

i can see a smil tag nested in ip -> tcp -> wsp tags. This is the line i care for:

<field name="smil.smil" showname="&lt;smil&gt;" size="522" pos="427" show="&lt;smil&gt;" value="...hex content...">

if a try to print it with:

tshark -R "mmse" -r mms.pcap -T pdml -e smil.smil -T fields

i get the content of showname and not of value property... i cannot get a clue about how to get value field... someone have an idea?

In second instance i want to ask you the best approach possible in writing a script or a program written in C that extract multimedia content from a MMSE filtered pcap file.

Thank you in advance, Davidone

asked 03 Dec '10, 08:27

Davidone's gravatar image

Davidone
1111
accept rate: 0%