This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark Info column out contains â┼' rather than the equivalent of right arrow

0

I use tshark to produce a packet list with the following command:

tshark -2 -q -ta -o transum.tsumenabled:FALSE -T fields -E separator=, -E quote=d -E header=y -e frame.number -e _ws.col.Time -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e _ws.col.Info -r _file_name_

Where the output should contain a right arrow showing the packet direction from one port to another it contains the character sequence â┼'

"802","15:18:30.322985","192.168.3.85","192.168.3.78","40301","80","40301 â┼' 80 [ACK] Seq=3302592562 Ack=2719576173 Win=39936 Len=0 TSval=78673786 TSecr=237550205"

Do I have a preference set incorrectly, or is this expected?

Thanks and regards...Paul

asked 08 Feb '17, 15:14

PaulOfford's gravatar image

PaulOfford
131●28●32●37
accept rate: 11%

What operating system are you using? If it's some flavor of UN*X (this includes, of course, Linux, *BSD, and macOS under all its names), what is the setting of the LANG environment variable?

(09 Feb '17, 00:12) Guy Harris ♦♦

Good point - I should have said. Windows 10 - English UK.

(09 Feb '17, 00:41) PaulOfford

Do you have a text editor that supports UTF-8 (not UTF-16, but UTF-8)? If so, could you send the output of the command to a file and open it in that file? TShark's output is UTF-8, but Windows doesn't do a very good job of supporting UTF-8 (there is a UTF-8 code page number, but I think a lot of software fails if you make that the code page).

(09 Feb '17, 01:29) Guy Harris ♦♦

And what shell are you using, cmd.exe, PowerShell, or something third-party, e.g. ConEmu?

What codepage is in use, i.e. what does chcp show?

(09 Feb '17, 03:57) grahamb ♦

Hi Graham, cmd.exe and chcp gave:

Active code page: 850
(09 Feb '17, 04:58) PaulOfford

When I use cmd.exe (and that codepage is in use for me as well) then I see the arrow in the output.

I'm reasonably confident that didn't always happen as I vaguely remember complaining about it, but I don't know what may have changed, either on my systems or in tshark.

What version of tshark?

(09 Feb '17, 05:15) grahamb ♦

v2.2.4-0-gcc3dc1b

(09 Feb '17, 09:30) PaulOfford

What font are you using in cmd.exe? Use cmd.exe window System Menu -> Properties -> Font tab.

(09 Feb '17, 09:54) grahamb ♦

Also, is the odd character visible on the console or are you redirecting to a file?

(09 Feb '17, 10:03) grahamb ♦

Font setting is Consolas

(09 Feb '17, 10:03) PaulOfford

On the console. If I redirect to a file I get:

→
(09 Feb '17, 10:06) PaulOfford

I have consolas (for cmd.exe) and see the arrow (Win 10 Pro English UK). Redirecting to a file does break things.

Thinking about it, that may have been my complaint I vaguely remembered.

(09 Feb '17, 10:27) grahamb ♦

Last straw to be clutched, what do you have set for the language for non-Unicode programs? Found in Control Panel -> Clock, Language, Region -> Region, Administrative tab.

I have English (United Kingdom).

(09 Feb '17, 10:37) grahamb ♦

Yep, same as you - English (United Kingdom)

(12 Feb '17, 23:08) PaulOfford

What happens if you chcp 65001?

(13 Feb '17, 13:10) cmaynard ♦♦

The output changes to →

(13 Feb '17, 14:30) PaulOfford

Strange.

As a quick test, I created a binary file whose contents is:

00000000  41 53 43 49 49 20 41 72  72 6f 77 73 3a 20 53 6f  |ASCII Arrows: So|
00000010  75 72 63 65 20 2d 3e 20  44 65 73 74 69 6e 61 74  |urce -> Destinat|
00000020  69 6f 6e 2c 20 44 65 73  74 69 6e 61 74 69 6f 6e  |ion, Destination|
00000030  20 3c 2d 20 53 6f 75 72  63 65 0a 0d 55 54 46 2d  | <- Source..UTF-|
00000040  38 20 41 72 72 6f 77 73  3a 20 53 6f 75 72 63 65  |8 Arrows: Source|
00000050  20 20 e2 86 92 20 44 65  73 74 69 6e 61 74 69 6f  |  ... Destinatio|
00000060  6e 2c 20 44 65 73 74 69  6e 61 74 69 6f 6e 20 e2  |n, Destination .|
00000070  86 90 20 20 53 6f 75 72  63 65                    |..  Source|
0000007a

Originally my codepage was 437, and "type arrows.hex" yielded:

ASCII Arrows: Source -> Destination, Destination <- Source
UTF-8 Arrows: Source  → Destination, Destination ←  Source

After a chcp 65001 and another "type arrows.hex", I got:

ASCII Arrows: Source -> Destination, Destination <- Source
UTF-8 Arrows: Source  → Destination, Destination ←  Source

... and col_append_ports() is definitely using UTF8_RIGHTWARDS_ARROW, so I thought this would work.

(13 Feb '17, 14:40) cmaynard ♦♦
showing 5 of 17 show 12 more comments