This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm trying to export a packet capture, which is decoded as "PEEKREMOTE". For example: tshark -r -d udp.port==5000,peekremote <file.pcap> ...and I'd like to save/export the 'decoded version' of file.pcap. Is that possible in either tshark or wireshark?

asked 25 Nov '13, 21:05

mike909's gravatar image

mike909
15236
accept rate: 0%


Is that possible in either tshark or wireshark?

No, that's not possible, as the "Decode as" action is only performed within Wireshark/tshark while it is running. If you save a decoded capture file, there will be no information added about your special configuration (decoding port 5000 as PEEKREMOTE).

Solution: If you want to have that as a permanent option, you can change the Wireshark preferences.

  • Select one of those packets with port 5000
  • then >Analyze -> Decode As -> Transport [tab] -> PEEKREMOTE (will only show up for UDP frames)
  • click Apply
  • click Show current
  • click Save

Wireshark will now save your 'Decode As' setting to the file 'decode_as_entries' in the folder %APPDATA%\Wireshark\, or a sub-folder if you are using profiles. Just search for the file name.

Content of decode_as_entries

# "Decode As" entries file for Wireshark 1.11.0-SVN-52212.
#
# This file is regenerated when saving the "Decode As..." list.
# So be careful, if you want to make manual changes here.

######## Decode As table entries, can be altered through command line ########

decode_as_entry: udp.port,5000,(none),PEEKREMOTE

Regards
Kurt

permanent link

answered 26 Nov '13, 03:58

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 26 Nov '13, 04:08

What do you mean by "export" and "decoded"? [Wire|t]shark can print the protocol tree as text or various forms of ML. Look under the File | Export Packet Dissections ... menu in Wireshark, and look at the -T options for tshark.

permanent link

answered 26 Nov '13, 01:52

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×89
×6

question asked: 25 Nov '13, 21:05

question was seen: 8,268 times

last updated: 26 Nov '13, 04:08

p​o​w​e​r​e​d by O​S​Q​A