This is our old Q&A Site. Please post any new questions and answers at

While creating different flows from pcap file (say trace.pcap) I am using following command

tshark -r trace.pcap -T fields -e frame.number -e ip.src -e ip.dst="" -e tcp.srcport -e frame.len –E separator=, -E header=y

It gives an error as::ip.dst is not a valid field. Can anyone help me in tracing this issue.

asked 03 Oct '14, 03:38

loneharoon's gravatar image

accept rate: 0%

Most likely it does not work because with display filter type syntax you need to use double equals, like

-e ip.dst==""

permanent link

answered 03 Oct '14, 03:40

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

I tried both ways like -e ip.dst=="" ,and -e "ip.dst==".

But still it is showing (tshark.exe:3228): WARNING : 'ip.dst==' isn't a valid field! tshark: Some fields aren't valid

(03 Oct '14, 04:11) loneharoon

Hm I guess than it is simply not possible to use filter syntax in combination with "-e", because it is just a field designation. If you try using "" without anything else it should work. In that case you need to filter with a read filter or display filter (by adding a -R or -Y parameter)

(03 Oct '14, 04:20) Jasper ♦♦

As Jasper said: "-e" is not for filters it's for fields. So you probably want something like:

tshark -r trace.pcap -T fields -e frame.number -e ip.src -e ip.dst -e tcp.srcport -e frame.len –E separator=, -E header=y -Yip.dst=""
permanent link

answered 03 Oct '14, 06:04

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 03 Oct '14, 03:38

question was seen: 3,903 times

last updated: 03 Oct '14, 06:04

p​o​w​e​r​e​d by O​S​Q​A