Is it possible to have separators using the method above? Normally I like to use -T fields -E but when pcap's are corrupt or ended in the middle of a packet transfer, the -T fields -E option doesn't work. The only thing that I have seen work with those files are the -o "gui.column.format" option. The only problem is that I write scripts to parse the data and without a separator the task gets rather tricky. If anyone knows of a way let me know. Thanks asked 14 Apr '14, 09:18 Nefarii |