This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Is there a command line parameter for “tshark” command to show raw bytes in addition to decoded stuff?

0

The following command will output all the decoded fields which is nice. I can pipe it to other program for more processing.

tshark -r temp.pcap -P -V

Wonder if there is a command parameter to make it output raw bytes (like in the wireshark, the pane for raw bytes).

Thanks.

asked 11 Apr '15, 18:44

sharkfun's gravatar image

sharkfun
26559
accept rate: 0%


One Answer:

2

tshark -r temp.pcap -P -V -x

answered 11 Apr '15, 20:36

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Thanks for the quick answer! It feels so obvious now that you pointed it out :-)

(11 Apr '15, 20:40) sharkfun