This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a dissector to decode the payload for an RTPS payload and it works fine in wireshark, but tshark does not seem to recogize the hand-off from RTPS to my sub-dissection routine.

Is there a way for tshark to be able use plugin dissectors. A command-line solution would be nice to use for automated checking of pcap files.

I have googled this as many ways as I can think of and can't seem to find an answer.

Thanks for any advice or suggestions.

asked 30 Jul '14, 13:17

FlanOSU's gravatar image

FlanOSU
16114
accept rate: 0%

Does your dissector require 2 pass dissection? Try passing command line option '-2' to tshark.

(30 Jul '14, 13:24) Jaap ♦

I would expect it to "just work".

(IOW: if a plugin works OK with wireshark, it should also be OK with tshark)

A long shot: what happens if you use tshark -2 ... ?

In any case, what platform/OS/version are you using ?

permanent link

answered 30 Jul '14, 13:23

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k1850
accept rate: 17%

edited 30 Jul '14, 13:25

I am running on a vm of Linux (RHEL 5).

The two pass option got me going in the right direction. I have to process the DDS publications in order to get a list of "upcoming" messages by GUID. I then have to use the GUID to correctly decode my payloads, which don't have typical header information like message id, length, etc...

I had an older version of wireshark/tshark that doesn't seem to support the two pass feature, but the latest wireshark build I was working with handles it correctly. Thanks for the assistance.

(30 Jul '14, 14:42) FlanOSU
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×37
×18

question asked: 30 Jul '14, 13:17

question was seen: 2,594 times

last updated: 30 Jul '14, 15:15

p​o​w​e​r​e​d by O​S​Q​A