changing the preference using tshark

Hi I need to the change the preference settings so that the tshark will dissect the heuristic dissector first and i need to give a command for that since i cant use the gui (manager has told me to try using only cli so cant help) please help!

tshark preferences

asked 18 Apr '11, 06:33

niks3089
21●15●15●18
accept rate: 0%

One Answer:

active answers oldest answers newest answers popular answers

tshark -o will do the trick.

-o name:value ... override preference setting

Use tshark -G defaultprefs to find the name of the pref you wish to change.

tshark -G defaultprefs gives a complete list of the default prefs

tshark -G currentprefs give a list of the currentprefs

I expect that in this case you'll want to do

tshark -o tcp.try_heuristic-first:TRUE

Also: you can use tshark -C to specify a particular profile to be used.

-C config_profile start with specified configuration profile

permanent link

answered 18 Apr '11, 06:40

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

edited 18 Apr '11, 06:55

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

tshark ×832
preferences ×39

question asked: 18 Apr '11, 06:33

question was seen: 12,615 times

last updated: 18 Apr '11, 06:55

changing the preference using tshark

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions