This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a way to use wireshark/tshark with options to generate the "analyze->expert info" output for an input/existing PCAP file?

thanks

asked 07 Feb '13, 16:32

donlex's gravatar image

donlex
11112
accept rate: 0%


Unfortunately that functionality is not implemented. The best you can do is this:

tshark -nr input.pcap -z expert -q

and/or

tshark -nr input.pcap -R "expert" -T fields -e frame.number -e expert -E occurrence=a

Regards
Kurt

permanent link

answered 07 Feb '13, 16:44

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 08 Feb '13, 02:02

The development version does have a tshark tap for this. e.g.

tshark -2 -r input.pcap -zexpert,<min-severity> -q

where min-severity can be error error | warn | note | chat

(08 Feb '13, 01:35) MartinM

The development version does have a tshark tap for this. e.g.

hm.. that option is already in the version 1.8.x. See my first example in the answer. Is the output different in the development version?

(08 Feb '13, 02:01) Kurt Knochner ♦

Oops, sorry, I didn't spot that your first example already uses it, and hadn't checked that it was already in 1.8. There have been no changes to the code for this since the 1.8 branch was created, so the form of the output would be the same.

If the functionality that the question wanted is not implemented, what is it that they are looking for?

(08 Feb '13, 04:31) MartinM

If the functionality that the question wanted is not implemented, what is it that they are looking for?

good question. Let's wait for an update of the OP.

(08 Feb '13, 12:05) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×33
×11

question asked: 07 Feb '13, 16:32

question was seen: 3,907 times

last updated: 08 Feb '13, 12:05

p​o​w​e​r​e​d by O​S​Q​A