Is there a way to create a column for Ethernet VLAN priority that displays the value (e.g. 0-7 decimal or 000-111 binary) instead of the verbose traffic class? I am capturing traffic and exporting to CSV for Excel analysis and graphing. I can export the verbose and then do a search and replace, or formula to glean the value, but that adds a significant amount of post-processing work that could be avoided if Wireshark just displayed the binary or decimal PCP value. asked 28 Jan '11, 09:31  Nick Del Regno |
One Answer:
Right-click on the column-title and de-select "Show Resolved" (not sure if this is available in 1.4.x though, you might need to install 1.5.0 for it). answered 28 Jan '11, 09:41  SYN-bit ♦♦ |
Thanks for the quick reply. I am using a Spirent modified version of 1.4.2 (for their signature decodes) and no "Show Resolved" option exists... Oh well.
The "Show Unresolved" option has only been in development versions at the moment. It will apparently be included in the official releas of V1.6.0.
If you can't run 1.5.0, you might be able to use tshark to get what you need.
Try something like:
tshark -r <file> -T fields -e frame.number -e frame.time -e vlan.id -e vlan.priority -e ip.src -e ip.dst -e ... > out.txt
All fields are by default separated by a TAB character which makes importing in Excel pretty easy.
Thanks folks for the info. SYNbit, I tried that and it will do the job until "Show Unresolved" is added to an official release. Thanks!