Hello, I am trying to conduct OS fingerprint using tshark. I have created a capture, saved it to the desktop and named it testshark.pcap, here is the command that I am typing: C:\Program Files\Wireshark>tshark -r "C:\Users\User 1\Desktop\testtshark tcp.flags.syn eq 1" - T fields -e ip.src -e ip.ttl -e tcp.window_size and this is the error I am receiving: tshark: "-T" was unexpected in this context. I have recently updated to Wireshark 2.0.2 and I am using a Windows 7 box. I have successfully done this in the past with an older version of wireshark, can someone please help? Lee G asked 07 Apr '16, 23:46  Lee_G wikified 11 Apr '16, 05:35 |
One Answer:
You should try this answered 07 Apr '16, 23:52  Christian_R |
As in, you borked the command line, which happens. One more detail: you may need to add ".pcap' to the filename as well.
What I can also see is the blank space between
-andTwhich is likely to cause another issue.Christian, your recommendation worked, you were right my syntax was flawed, Kudos to you sir! BTW, love your website, very informative.