This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, Is it possible in tshark to directly convert value to exact meaning text? I need similary like as: "tshark -r pcap -V" but I need it only on exact fields.

For example: tshark -r smpp.pcap -T fields -e smpp.command_id

0x80000015
0x80000004
0x00000004
0x80000004
0x00000004

Now I need to change to correct text like as (Submit_sm,Deliver_sm,and so on..) Something like tshark -e _ws.col.Info but I need it per argument for example _ws.col.smpp.command_id? Don't focus on protocol; I need it globally for a lot of different protocols.

Thanks a lot. Regards, Peter

asked 01 Mar '16, 00:52

zuvo's gravatar image

zuvo
11114
accept rate: 0%

edited 20 Jul '16, 13:51

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142


To achieve this, you could try explicitly specifing the exact columns that you want to be displayed. For example, this will display the frame number and smpp.command_id for SMPP matching frames:

On *nix:

tshark -o 'gui.column.format:"No.","%m","SMPP Commmand ID","%Cus:smpp.command_id"' -Y "smpp" -r smpp.cap

On Windows:

tshark.exe -o "gui.column.format:\"No.\",\"%m\",\"SMPP Command ID\",\"%Cus:smpp.command_id\"" -Y "smpp" -r smpp.cap

Sample output:

 4 Bind_transmitter
 5 Bind_transmitter - resp
 7 Enquire_link
 8 Enquire_link - resp
 9 Submit_sm
10 Submit_sm - resp
12 Unbind
13 Unbind - resp

You can display just about any field using %Cus. For the so-called "built-in" fields, run tshark -G column-formats to see the specifiers needed (such as %m for the frame number in the example above).

You can also just run Wireshark and configure the columns you want there and then run tshark without the need to specify the columns, since tshark will just use the Wireshark-configured columns by default.

If you only want to use some of Wireshark's configured columns, you can pick and choose the ones you want using the -T fields -e field1 -e field2 ... syntax, specifying -e _ws.col.Operation for the SMPP Operation/Command ID field, "Operation" being the default name of the column when you right-click the field in Wireshark and choose, "Apply as column".

permanent link

answered 20 Jul '16, 13:49

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×19
×9
×7
×4

question asked: 01 Mar '16, 00:52

question was seen: 1,234 times

last updated: 20 Jul '16, 13:51

p​o​w​e​r​e​d by O​S​Q​A