This is our old Q&A Site. Please post any new questions and answers at

In Wireshark, in packet details, sometimes a field occurs more than once, i.e. sometimes it is nested inside more than one nodes. If I want to read the .pcap file in tshark and filter a particular field which occurs more than once under different nodes, can I specify which one I want?

For example, in the following screenshot, there is a field called Good Checksum nested under a node called Checksum. JUST SUPPOSE that Good Checksum also occurred at another place under another node, for the same node, say theOtherNode. The Tshark field for Good Checksum is tcp.checksum_good. So the normal Tshark command that I know of is

tshark -r filename.pcap -T fields -e tcp.checksum_good

The question is, that in Tshark, can I specify that I want the tcp.checksum_good nested under Checksum, and not the one nested under theOtherNode?

alt text

asked 04 Oct '16, 00:09

Jesss's gravatar image

accept rate: 0%

Unfortunately, currently there is no way to do so for fields which occur at the same encapsulation level. For your particular case where the two identically named fields exist at different encapsulation levels, you could possibly "misuse" MATE, which allows to specify the list of transport layers below which no extraction is performed, to extract your desired field into a new one like mate.mypdu.myfield which you would then refer to using -e. But the possibility would still depend on the particular arrangement of the protocols in the frame, and the MATE fields are always ASCII regardless what the source fields' format was.

permanent link

answered 04 Oct '16, 01:51

sindy's gravatar image

accept rate: 24%

The tshark -E occurrence=f|l|a option allows you to specify the first, last or all occurrences of each field. This setting is for all specified fields, not on a per field basis.

permanent link

answered 04 Oct '16, 02:20

grahamb's gravatar image

grahamb ♦
accept rate: 22%

True, but the OP wanted to filter on a particular occurrence, while -E occurrence only controls what the -e shows.

(04 Oct '16, 02:29) sindy

It wasn't clear to me if the OP did want to filter as in display or capture filter or filter the output to restrict the occurrence of a repeated field. Unfortunately the term filter is used (and misused) in many ways by Wireshark folks.

If the occurrence the OP wants displayed is the first (or last) then the issue is resolved :-)

(04 Oct '16, 02:47) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Oct '16, 00:09

question was seen: 2,139 times

last updated: 04 Oct '16, 02:47

p​o​w​e​r​e​d by O​S​Q​A