Hi I am using the command "tshark output.pcap -V -r > output.txt" to convert the file from pcap to text.But the display it is coming in "All expanded" format. I want to convert pcap to text file with packet details as "As dispalyed" format using tshark command. asked 04 Sep '14, 23:54  ramkumarbarai |
One Answer:
TShark is a command-line program, not a GUI program, so it has no display and can't export "as displayed", because there's no "displayed" to show; Wireshark doesn't save the list of items it's opened for use by TShark later, so TShark can't write out a text file in the form that Wireshark last displayed. The only thing you can do is use the -O flag rather than the -V flag; the -O flag takes a comma-separated list of protocol abbreviation names, and opens up the items for those protocols. answered 05 Sep '14, 00:36  Guy Harris ♦♦ |
