This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

tshark error - unexpected argument

0

hello

> C:\Program Files\Wireshark>tshark -r normal.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -E header=y -E separator=, quote=d -E occurrence=f

tshark: "=" was unexpected in this context.

what’s wrong o_O

asked 10 May ‘16, 11:30

Khadidja%20Khadidja's gravatar image

Khadidja Kha…
41●5●6●11
accept rate: 0%

edited 10 May ‘16, 13:52

sindy's gravatar image

sindy
6.0k●4●8●51

One Answer:

0

You should try this:
C:\Program Files\Wireshark>tshark -r normal.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -E header=y -E separator=, -E quote=d -E occurrence=f


I think you missed the -E in front of quote=d

answered 10 May '16, 12:12

Christian_R's gravatar image

Christian_R
1.8k●2●6●25
accept rate: 16%

thanks for your response it works now :) I have another question ^^, SORRY I am a beginner I want to convert normal.pcap file to csv file but I get

C:\Program Files\Wireshark>tshark -r normal.pcap -T fields -e frame.number -e frame.time -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.proto -E header=y -E separator=, -E quote=d -E occurrence=f > test.csv Accès refusé.

what is the pb here.

thanks in advance

(10 May '16, 13:14) Khadidja Kha...

As a normal user you are not allowed to write to C:\Program Files...

You should do like: > C:\YOUR DOCUMENTS\test.csv

(10 May '16, 13:44) Christian_R

thanks ^^ the problem is solved

(10 May '16, 14:10) Khadidja Kha...