This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark with -Tfield: How to make address resolution and output format work?

1

Hi, Is there a way to make MAC address resolution work in tshark output? I use this command:

c:\Program Files\Wireshark>tshark -T fields -Eheader=y -Eseparator=, -Eaggregator=\s -eframe.number -eframe.time_relative -ewlan.sa -ewlan.fc.type_subtype -ewlan.da -r sample80211.pkt

And the output lines looks like the line below:

22,20.556985855,00:0d:67:30:3c:1c,0x08,ff:ff:ff:ff:ff:ff

I cannot get the mac address resolved using global manuf file when -Tfields is used with -e. In wireshark or regular tshark output I see 'Ericsson_30:3c:1c' instead of 00:0d:67:30:3c:1c'. Perhaps I am missing something.

In general, is there anyway to format the field output? E.g to have a similar content as Wireshark shows? In the example above, tshark when used with -Tfield prints wlan.fc.type_subtype as numerical value 0x08 for a Beacon frame. If I create a column in wireshark for this field I will see the string 'Beacon' (and same if I export it to CSV). Is there a way to get the same from tshark using -Tfield/-e options?

Many thanks for help, Arezoo

asked 08 Mar '13, 11:58

Arezoo's gravatar image

Arezoo
26113
accept rate: 0%