This is our old Q&A Site. Please post any new questions and answers at


I'd like to know if it's possible to make tshark output packets with port number. For example, I use the following command:

tshark -R "ip.addr=="

and I get:

163.742781 -> SIP Request: INVITE sip:[email protected];user=phone

163.743301 -> ICMP Destination unreachable (Port unreachable)

and here I don't see what port the INVITE was sent to. Is there an option to have a port in the output?


asked 13 Dec '12, 02:00

ky4k0b's gravatar image

accept rate: 0%

You could try to build your own customized output.

tshark -r input.cap -R "ip.add ==" -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -xxx

where XXX is all SIP/VOIP fields you are interested in. The port number would be (-e You will get all available fields with

tshark -G fields

Suggestion (please adjust to your needs!)

tshark -r input.cap -R "ip.addr ==" -T fields -e frame.number -e frame.time_delta -e ip.src -e ip.dst -e "sip.Request-Line -e

BTW: the ICMP port unreachable message directly after the SIP INVITE makes me believe, that your system does not accept traffic to port UDP 5060 (SIP) and thus it sends a "port unreachable" message.


permanent link

answered 14 Dec '12, 07:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

thanks a lot Kurt!

I knew that I can do it with -e flag and add custom params. I was just wondering if there's a dummy mode (like another flag) to display port in the output :)

(20 Dec '12, 02:13) ky4k0b

well, you can use the option -V or -T pdml but then you get a lot of data and you need some script to extract the parts you are interested in.

(20 Dec '12, 03:34) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 Dec '12, 02:00

question was seen: 11,109 times

last updated: 20 Dec '12, 03:34

p​o​w​e​r​e​d by O​S​Q​A