"user_dlt" option in tshark?

Question

GUI based wireshark provide USER_DLT Encapsulation. Command based tshark provide same or even a similar option?

thanks.

Answer 1

2

Hi,

with tshark you can use the following command line as an example:

tshark.exe" -o "uat:user_dlts:\"User 15 (DLT=162)\",\"payload protocol\",\"header size\",\"header protocol\",\"trailer size\",\"trailer protocol\""

permanent link

answered 09 Sep '13, 07:02

Pascal Quantin
5.5k●10●60
accept rate: 30%

-o "uat:user_dlts:

nice, I did not know about that feature.

Shouldn't that be part of the tshark man page? ;-)

(09 Sep '13, 07:54) Kurt Knochner ♦

You have a trillion packets.