This is our old Q&A Site. Please post any new questions and answers at

Hi All, I am working on tshark -T option to export fields to .csv file. I successfully performed the conversion using tshark -r input.pcap -T fields -e field_name -E separator=,

I have tried field name ip.src , ip.dst and frame.number. I would like to know the all field names which I can use in exporting .csv file.


asked 16 Feb '14, 21:52

Aditi's gravatar image

accept rate: 0%

edited 17 Feb '14, 02:04

grahamb's gravatar image

grahamb ♦

There are lots of fields, use tshark -G fields to list them all

permanent link

answered 17 Feb '14, 02:09

grahamb's gravatar image

grahamb ♦
accept rate: 22%

or check the online docs

(17 Feb '14, 02:17) Kurt Knochner ♦

Thanks Kurt,

As you suggested I got all the field list, upon checking them, I find lot other fields in all protocols, say IP protocol, I found and ip.src_rt. As per my knowledge, there is no filed for or src_rt in IP protocol header. I could not understand that from where wireshark/ tshark will capture all this details if it is not at all available in packet itself....

(19 Feb '14, 22:37) Aditi

Some fields are synthesized by Wireshark from the information in the capture and sometimes using external sources.

In the case of the two fields mentioned, is set via ip to geographic location lookup and the second field ip.src_rt is set if the packet contains IP source routing options, either LSSR or SSRR, see RFC 791

(20 Feb '14, 05:44) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 16 Feb '14, 21:52

question was seen: 4,739 times

last updated: 20 Feb '14, 05:44

p​o​w​e​r​e​d by O​S​Q​A