This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to use tshark to produce either a tab or comma delimited file with various fields from a pacap file that I have. I have tried 2 different methods and each has it's own shortcoming. I am hoping that some one can help remedy my ignorance. I have been searching here, google, and a few other sites with no luck.

First method: tshark -r <pcapfile.pcap> -t ad -E header=y -E separator=/t -T fields -e frame.number -e frame.time -e tcp.stream -e ip.src -e ip.src_host -e ip.dst -e ip.dst_host -e Protocol

First Result: With this I get most of the data that I want. But I have not been able to to to get the contents of Wiresharks 'Protocol' Column. I have used both -e protocol and -e Protocol as the filed name, neither generates an error or provides data. But -e fred does the same. In Wireshark the column details are displayed as 'Protocol' (no 's), in the preferences file the protocol column is defined as %p. Using -e %p does generate and error.

Second method: tshark -r <pcapfile.pcap> -t ad -E header=y -E separator=/t -C <profilename>

Second Result: This does output all of the same data that I see in Wireshark. But, I seem to not be able to get column headers or field separators.

Now that I have went through all of this, It seems that what I want to know is 2 basic questions; 1) how can I get the 'paramterized' columns from Wireshark like 'Protocol(%p)', 'Cumulative Bytes(%B)',etc. list listed by tshark in formatted text?

2) how can I get tshark to display formatted text (headers and files separators) when using a configuration profile "-C" parameter.

Any help with this would be greatly appreciated.

asked 02 May '14, 15:20

astrader's gravatar image

astrader
26336
accept rate: 0%


In general, to display an arbitrary column, use -e col.column name, so in your case you could use -e col.Protocol to display the contents of the Protocol column.

permanent link

answered 02 May '14, 16:18

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

That is exactly what I was looking for. That is exactly the bit of ignorance that was holding me up. I was not aware ot the col item.

Thanks!

(02 May '14, 16:26) astrader

As of the 1.11.x and 1.12 versions of tshark, the field names are "_ws.col.Protocol" and "_ws.col.Info", instead of "col.Protocol" and "col.Info".

Example:

tshark -T fields -e _ws.col.Protocol -e _ws.col.Info

Source: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10201

permanent link

answered 19 Jun '14, 16:59

CraigGarrett's gravatar image

CraigGarrett
8613
accept rate: 0%

edited 20 Jun '14, 10:20

thanks for the update. I will have to grab a newer version and give this a try.

(20 Jun '14, 12:17) astrader
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×22
×1

question asked: 02 May '14, 15:20

question was seen: 3,252 times

last updated: 20 Jun '14, 12:17

p​o​w​e​r​e​d by O​S​Q​A