This is our old Q&A Site. Please post any new questions and answers at

Hi all,

I want to use tshark -T and -e to extract data from PCAP file. Some of the data are ipv4 data, some are ipv6 data.

I'm using this line now:

tshark -r test.pcap -T fields -e frame.number -e eth.src -e eth.dst -e ip.src -e ipv6.src -e ip.dst -e ipv6.dst -e frame.len -E header=y -E separator=, > test1.csv

then there would be empty fields in test1.csv, since the ipv4 data won't have ipv6.src and ipv6.dst.

Is there a way to select ip.src or ipv6.src, like -e "ip.src or ipv6.src"

asked 30 Oct '16, 14:14

zpymyyn's gravatar image

accept rate: 0%

Nothing like -e "field_1 or field_2" exists for a generic case, but in your particular one, -e _ws.col.Source should output either ip.src or ipv6.src, depending on their presence in the frame. I have no clue which one is output if both are present in the same frame, though.

permanent link

answered 30 Oct '16, 14:39

sindy's gravatar image

accept rate: 24%

Hi sindy, thanks a lot!

(30 Oct '16, 15:01) zpymyyn

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(31 Oct '16, 02:43) Jaap ♦

But beware of bug 13020.

(31 Oct '16, 02:44) Jaap ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 30 Oct '16, 14:14

question was seen: 1,625 times

last updated: 31 Oct '16, 02:44

p​o​w​e​r​e​d by O​S​Q​A