This is our old Q&A Site. Please post any new questions and answers at

In Tshark CLI, we can use the commandline argument -T fields, and then follow it with -e argument, whose value has to be the name of the field I want to print.

But where are my options? What values can I use for -e?

Where can I find all the fields that I can choose from? How do you get to know what field you need to use?

asked 20 Aug '16, 07:31

Jesss's gravatar image

accept rate: 0%

The protocol fields that can be used for display filter can also be used as values to -e in tshark. So you have three possibilities how to find the ones you need:

  • in the relevant Wireshark documentation

  • by running Wireshark and using the Expression... button next to the display filter form field to open a tree with all protocols and their fields.

  • by starting to type a protocol name into the display filter and using the context completion.

On top of the actual protocol fields, you can use also column headers from packet list as arguments to -e if you put _ws.col. in front of the column name. An example would be -e _ws.col.Info

permanent link

answered 20 Aug '16, 10:54

sindy's gravatar image

accept rate: 24%

Or by using the command tshark -G fields that dumps all the registered fields

permanent link

answered 20 Aug '16, 12:14

Pascal%20Quantin's gravatar image

Pascal Quantin
accept rate: 30%

edited 20 Aug '16, 23:56

sindy's gravatar image


Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 20 Aug '16, 07:31

question was seen: 26,800 times

last updated: 01 Aug '17, 16:35

p​o​w​e​r​e​d by O​S​Q​A