This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

export packet decode via GUI

0

I've been using Tshark line like this a lot lately:

tshark.exe -r somefile.pcap -R 'frame.number==5' -V

which gives me a nice complete plaintext decode of a single frame. I'm sure there must be a way to get the whole packet decode as plain text in the GUI after applying the display filter, but I just can't find it. What am I missing?

asked 04 Apr '11, 15:50

jswan's gravatar image

jswan
6●1●1●2
accept rate: 0%

2 Answers:

2

Try this:

  1. Apply the display filter after loading the trace
  2. Choose "File" -> "Export" -> "File"
  3. Select "Save as Type" as "Plain Text"
  4. Mark "Packet Range" radio button as "Displayed"
  5. Set the Packet Format according to your wishes, usually only "Packet Details" -> "All Expanded" or "As displayed"

Is that what you were looking for?

answered 04 Apr '11, 18:01

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

0

That's it! I was missing the "as displayed" option under "Packet details".

answered 05 Apr '11, 07:35

jswan's gravatar image

jswan
6●1●1●2
accept rate: 0%