I've got a custom wireshark dissector that is just a stats tree. I want to change a uat param when I invoke tshark. It seems like this should work, but it doesn't: tshark -r C:\Development\pcap\http.cap -q -o "uat:num_lbg_ports:\"8\"" -z ixbal,tree My preference file, named num_lbg_ports, has this content: # This file is automatically generated, DO NOT MODIFY. So my uat has a single param, which is a gint16, and there is one record in the table in the file. But when tshark runs, it uses the value from the file, not the value on the command line. Can anybody tell me what I'm doing wrong? BTW, the same command does work if I delete the num_lbg_ports file - but the command line argument is supposed to override the file, right? I am working on a Windows XP system, if that matters. asked 08 Apr '14, 16:25  lannie |
One Answer:
Never mind, I figured it out. The param that is passed in the command line becomes an additional record in the uat. I simply need to make sure I always use the last record in the uat, for a param that only needs one record. answered 08 Apr '14, 19:42 lannie |
