This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Printing decoded values of fields using Tshark

0

I use tshark(in Windows) often to print some required fields from a pcap file for analysis. For example, i use this when i like to print the RAT type fields.

C:\Program Files\Wireshark> ./tshark.exe -r "C:\Work\GTP-diameter.cap" -Y "gtpv2 || diameter" -T fields -e frame.number -e diameter.RAT-Type -e gtp.ext_rat_type
1               1
2       1000
3
18      1000
29              2
30      1001

However, this prints the value but not the decoded text. Is there any way to print the decoded text as we see in wireshark? The Wireshark GUI shows the values like the one below.

GTP:

RAT Type: UTRAN (1)
RAT Type: GERAN (2)

Diameter:

RAT-Type: UTRAN (1000)
RAT-Type: GERAN (1001)

Thanks

asked 19 Aug '16, 01:42

gouthamraj91's gravatar image

gouthamraj91
6112
accept rate: 0%