I want to parse the standard header outputs of tshark. Since the default doesn't work, I am using a custom field parser that does almost the same thing. What I am missing is the resolution of the name of the protocol. My command is:
This almost works, what I get is (this example is capturing two pings):
The same two pings look like this in the normal, no custom field tshark:
The main difference that I need to solve is in mine I get asked 10 Sep '13, 21:54 jdwiegman |
2 Answers:
Like always happens, you work on a problem for days, post the question then find the answer. answered 10 Sep '13, 22:00 jdwiegman |
As of the 1.11.x and 1.12 versions of tshark, the field names are "_ws.col.Protocol" and "_ws.col.Info", instead of "col.Protocol" and "col.Info". Example:
Source: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10201 answered 19 Jun '14, 17:00 CraigGarrett edited 20 Jun '14, 10:19 |