I've been using Tshark line like this a lot lately:
tshark.exe -r somefile.pcap -R 'frame.number==5' -V
which gives me a nice complete plaintext decode of a single frame. I'm sure there must be a way to get the whole packet decode as plain text in the GUI after applying the display filter, but I just can't find it. What am I missing?
asked 04 Apr '11, 15:50
Is that what you were looking for?
answered 04 Apr '11, 18:01
That's it! I was missing the "as displayed" option under "Packet details".
answered 05 Apr '11, 07:35