This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I use tshark(in Windows) often to print some required fields from a pcap file for analysis. For example, i use this when i like to print the RAT type fields.

C:\Program Files\Wireshark> ./tshark.exe -r "C:\Work\GTP-diameter.cap" -Y "gtpv2 || diameter" -T fields -e frame.number -e diameter.RAT-Type -e gtp.ext_rat_type
1               1
2       1000
3
18      1000
29              2
30      1001

However, this prints the value but not the decoded text. Is there any way to print the decoded text as we see in wireshark? The Wireshark GUI shows the values like the one below.

GTP:

RAT Type: UTRAN (1)
RAT Type: GERAN (2)

Diameter:

RAT-Type: UTRAN (1000)
RAT-Type: GERAN (1001)

Thanks

asked 19 Aug '16, 01:42

gouthamraj91's gravatar image

gouthamraj91
6112
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×15

question asked: 19 Aug '16, 01:42

question was seen: 969 times

last updated: 19 Aug '16, 01:42

p​o​w​e​r​e​d by O​S​Q​A